Logical Methods in Computer Science 
Vol. 5 (2:2) 2009, pp. 1-38 
www.lmcs-online.org 



Submitted Dec. 19, 2007 
Published Apr. 9, 2009 



NEIGHBOURHOOD STRUCTURES: 
BISIMILARITY AND BASIC MODEL THEORY* 



HELLE HVID HANSEN", CLEMENS KUPKE 6 , AND ERIC PACUIT C 

a Eindhoven University of Technology, FM group, P.O. Box 513, 5600 MB Eindhoven, Netherlands. 
e-mail address: h.h.hansen@tue.nl 

b Imperial College London, Department of Computing, 180 Queen's Gate, London SW7 2AZ, UK. 
e-mail address: ckupke@doc.ic.ac.uk 

c Stanford University, Department of Philosophy, Stanford, CA 94305-2155, USA. 
e-mail address: pacuit@stanford.edu 



Abstract. Neighbourhood structures are the standard semantic tool used to reason about 
non-normal modal logics. The logic of all neighbourhood models is called classical modal 
logic. In coalgebraic terms, a neighbourhood frame is a coalgebra for the contravariant 
powerset functor composed with itself, denoted by 2 2 . We use this coalgebraic modelling 
to derive notions of equivalence between neighbourhood structures. 2 2 -bisimilarity and 
behavioural equivalence are well known coalgebraic concepts, and they are distinct, since 
2 2 does not preserve weak pullbacks. We introduce a third, intermediate notion whose wit- 
nessing relations we call precocongruences (based on pushouts). We give back-and-forth 
style characterisations for 2 2 -bisimulations and precocongruences, we show that on a single 
coalgebra, precocongruences capture behavioural equivalence, and that between neighbour- 
hood structures, precocongruences are a better approximation of behavioural equivalence 
than 2 2 -bisimulations. We also introduce a notion of modal saturation for neighbourhood 
models, and investigate its relationship with definability and image-finiteness. We prove a 
Hennessy-Milner theorem for modally saturated and for image-finite neighbourhood mod- 
els. Our main results are an analogue of Van Benthem's characterisation theorem and a 
model-theoretic proof of Craig interpolation for classical modal logic. 



1. Introduction 

Neighbourhood semantics |13| forms a generalisation of Kripke semantics, and it has 
become the standard tool for reasoning about non-normal modal logics in which (Kripke 
valid) principles such as Dp A Dq — * D(p A q) and Dp — > D(p V q) are considered not to 
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hold. In a neighbourhood model, with each state one associates a collection of subsets of 
the universe (called its neighbourhoods), and a modal formula Oip is true at a state s if 
the truth set of (p is a neighbourhood of s. The modal logic of all neighbourhood models is 
called classical modal logic. 

Neighbourhood semantics was invented in 1970 by Scott and Montague (independently 
in [H] and [31]); and Segerberg [32] presents some basic results about neighbourhood mod- 
els and the classical modal logics that correspond to them. These and other salient results 
were incorporated by Chellas in his textbook [13]. During the past 15-20 years, non-normal 
modal logics have emerged in the areas of computer science and social choice theory, where 
system (or agent) properties are formalised in terms of various notions of ability in strate- 
gic games (e.g. [H |38]). These logics have in common that they are monotonic, meaning 
they contain the above-mentioned formula Op — > D(pV q). The corresponding property of 
neighbourhood models is that neighbourhood collections are closed under supersets. Non- 
monotonic modal logics occur in deontic logic (see e.g. [T7]) where monotonicity can lead 
to paradoxical obligations, and in the modelling of knowledge and related epistemic no- 
tions (cf. [l3l |33]). Furthermore, the topological semantics of modal logic can be seen as 
neighbourhood semantics (see [TT] and references). 

Neighbourhood frames are easily seen to be coalgebras for the contravariant powerset 
functor composed with itself, denoted 2 . From a coalgebra point of view, neighbourhood 
structures are interesting since they constitute a general framework for studying coalgebraic 
modal logics in the style of Pattinson [35] , where modalities are defined in terms of predicate 
liftings. It can easily be shown that any (unary) modality defined in this way, can be viewed 
as a neighbourhood modality. Furthermore, in much work on coalgebra (cf. [3S]) it is often 
assumed that the functor preserves weak pullbacks, however, it is not always clear whether 
this requirement is really needed. In [19 , weaker functor requirements for congruences are 
studied, and 2 provides an example of a functor which does not preserve weak pullbacks 
in general, but only the special ones consisting of kernel pairs. 

From the modal logic point of view, coalgebra is interesting since it offers an abstract 
theory which can be instantiated to neighbourhood models, and help us generalise the 
well-known Kripke notions such as bisimilarity and image-finiteness to neighbourhood mod- 
els. For monotonic neighbourhood structures, these questions have already been addressed 
(cf. |36| 120] [2Tj ) . but as mentioned in |36j . if one starts from elementary intuitions, it is 
not immediately clear how to generalise monotonic bisimulation to arbitrary neighbourhood 
structures. The theory of coalgebra provides us not with one, but with several notions of 
state equivalence in F-coalgebras for an arbitrary functor F. F-bisimilarity and behavioural 
equivalence are well known concepts, and it is generally known that the two notions coin- 
cide if and only if the functor F preserves weak pullbacks [39]. This is, for example, the 
case over Kripke frames which are coalgebras for the covariant powerset functor V, and it 
explains some of the fundamental properties of Kripke bisimulation: (i) Kripke bisimula- 
tions are characterised by back- and- forth conditions, which makes it possible to efficiently 
compute Kripke bisimilarity over finite models as a greatest fixed point, (ii) The Hennessy- 
Milner theorem for normal modal logic states that over the class of finite Kripke models, 
two states are Kripke bisimilar if and only if they satisfy the same modal formulas, (iii) 
Van Benthem's characterisation theorem [7] [8] tells us that Kripke bisimilarity characterises 
the modal fragment of first-order logic. These properties of Kripke bisimulations form the 
starting points of our investigation into equivalence notions in neighbourhood structures 
and classical modal logic. 
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As neighbourhood structures are coalgebras for a functor that does not preserve weak 
pullbacks, it is to be expected that only behavioural equivalence will give rise to a Hennessy- 
Milner theorem for classical modal logic. However, it turns out to be very difficult to give a 
back-and-forth style characterisation of behavioural equivalence. This motivates our intro- 
duction of a third equivalence notion whose witnessing relations we call preco congruences, 
since they can be seen as a two-coalgebra analogue of the precongruences from [I] . 

The main contributions of this paper are: (1) the introduction of precocongruences 
and basic results which relate them to bisimulations and behavioural equivalence. In par- 
ticular, we show that on a single coalgebra, the largest precocongruences is behavioural 
equivalence (Theorem 3.12), and that over neighbourhood models, precocongruences are 
a better approximation of behavioural equivalence than 2 2 -bisimilarity; (2) the definition 
of a notion of modal saturation for neighbourhood models, which leads to a behavioural- 
equivalence-somewhere-else result (Theorem 4.27) by showing that ultrafilter extensions are 
a Hennessy-Milner class; (3) a Van Benthem style characterisation of the classical modal 
fragment of first-order logic (Theorem |5.5[); and (4) a model-theoretic proof of Craig inter- 



polation for classical modal logic (Theorem 5.11). 

In section [2] we define basic notions and notation. In section [3] we define precocon- 
gruences and investigate their relationship with bisimulations and behavioural equivalence. 
We also instantiate all three notions to the concrete case of neighbourhood frames, provide 
back-and-forth style characterisations for 2 2 -bisimulations and precocongruences, and prove 
the results mentioned in (1). In section |4j we introduce our notion of modal saturation for 
neighbourhood models, and use it to prove a Hennessy-Milner theorem for the class of finite 
neighbourhood models. We then use general coalgebraic constructions to define image-finite 
neighbourhood models and ultrafilter extensions of neighbourhood models, and show that 
these are also Hennessy-Milner classes. Finally, in section [5] we prove our main results as 
described in (3) and (4) above. In particular, we demonstrate that 2 -bisimulations are a 
useful tool for proving Craig interpolation of classical modal logic. 

Since neighbourhood structures are of general interest outside the world of coalgebra, 
we have tried to keep this paper accessible to readers who are not familiar with coalgebraic 
modal logic. This means that some of our results could be obtained by instantiating more 
general results in coalgebra. When this is the case, we give a brief explanation in the 
form of a remark of how the general coalgebraic framework instantiates to neighbourhood 
structures. However, these remarks are not necessary for understanding the main results 
of the paper. On the other hand, we also hope that these remarks will inspire readers to 
study the more general results. 



2. Preliminaries and notation 

In this section, we settle on notation, define the necessary set-theoretic and coalgebraic 
notions, and introduce neighbourhood semantics for modal logic. For further reading on 
coalgebra we refer to [39 , 44 . We assume the reader is familiar with the Kripke semantics 
and the basic model theory of normal modal logic. Some knowledge of more advanced 
topics such as modal saturation and ultrafilter extensions will be useful. All the necessary 
background information can be found in [ID]. Extensive discussions on neighbourhood 
semantics can be found in [42|, H3] [20] . 
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2.1. Functions and relations. Let X and Y be sets. We denote by V(X) the powerset 
of X, and by X + Y the disjoint union of X and Y. If Y C X, then we write ty for the 
inclusion map ty ■ Y ^ X; Y c for the complement X \ Y of Y in X; V C w X if Y is a finite 
subset of X; and j Y = |Y' CJ|7C Y'} for the upwards closure of {Y} m "P(X). 

For a function / : X ^ Y and subsets [/CI and Y C Y we define the aVeci f -image 
of U and the f-preimage of V by putting /[[/] := {/(x) | x G U} and / _1 [Y] := {x G 
X | /(x) G V}, respectively. Furthermore we call dom(/) := X the domain of / and 
we call rng(/) := f[X] the range of f. More generally, we also define the notions image, 
preimage, domain and range for a relation R C X x Y. For J7 C X and Y C Y, we 
denote the R-image of U by R[U] = {y G Y \ 3x G U : xRy}, and the R-preimage ofV by 
i? _1 [V] = {x e X \ 3y eV : xRy}. The domain of R is dom(i?) = i? _1 [Y], and the range of 
R is rng(i?) = R[X]. We will often work with a relation in terms of its projection maps. Let 
R C X\ x X 2 be a relation. The maps tt\ : R — ► Xi and 7T2 : i? — > X2 denote the projections 
defined for all (xi, X2) G R by 7Tj((xi, X2)) = Xi, for i = 1,2. R is called a bitotal relation if 
7Ti and 7T2 are surjective. Note that for Ui C Xj, i = 1,2, we have = vr2[7r^ 1 [t r i]] and 

i?- 1 ^] =vr 1 [7r 2 - 1 [[/ 2 ]]. 

If i? C X x X, then we denote by R e the smallest equivalence relation on X which 
contains -R, and if R is an equivalence relation on X then X/ i? is the set of ^-equivalence 
classes. A relation R C Xi x X2, can be viewed as a relation Rx x +x 2 011 -^1 + -^2 by 
composing the projections with the canonical inclusion maps l± : Xi — > X± + X2 and 
(-2 : X 2 -»■ Xi + X 2 . More precisely, -Rx!+x 2 = {(ti(ari), t 2 (ar 2 )) | (xi,x 2 ) G R}. 

Throughout this paper the notion of coherence will be used extensively. 

Definition 2.1. Let X\ and X2 be sets, R C Xi x X2 a relation, ?7i C Xi and ^7 2 ^ X 2 . 
The pair (f7i, t/ 2 ) is R-coherent if: C C/ 2 and R~ 1 [U2\ Q U±. For a set X, a relation 

i? C X x X and U C X, we say that ?7 is R-coherent, if ([/, C/) is i?-coherent. 

If C Xi x X 2 , then trivially, (0,0) and (Xi,X 2 ) are i?-coherent. Note that if R is 
an equivalence relation, then an incoherent subset U is often called R-closed. We list a 
number of useful properties of i?-coherence in the following two lemmas. Their easy, but 
instructive, proofs are left to the reader. 

Lemma 2.2. Let R C X\ x X 2 he a relation with projections tt,i : R — > Xj, i = 1,2. For all 
U\ C Xi and ^7 2 ^ X 2; the following are equivalent: 

(1) {U\,U2) is R-coherent. 

(2) /or all (x 1 ,x 2 ) G i?: xi G U\ ^ x 2 G U 2 . 

(3) vrr 1 [C/ 1 ]=7r 2 - 1 [^2]. 

(4) ?7i + U 2 is Rx L +x 2 - c °herent. 

Lemma 2.3. Let R C X x X be a relation and [/CI. The following are equivalent: 

(1) U is R-coherent. 

(2) U is R e -coherent, i.e. R e -closed. 

(3) U is a union of R e - equivalence classes. 

(4) U c is R e -coherent. 

2.2. Classical modal logic and neighbourhood semantics. Let At = {pj \ j G u>} be 

a countable set of atomic sentences. The basic modal language over At, denoted £(At), is 
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defined by the grammar: 

ip :: = J. | pj | -up | <f A ip | Dip, 
where j G w. We define T, — > and <-> in the usual way. We will assume At to be fixed, and 
to ease notation, we write C instead of £(At). 

Definition 2.4. A neighbourhood frame is a pair (S, v) where S is a set of states and 
u: S —* V(V(S)) is a neighbourhood function which assigns to each state s G S its collection 
of neighbourhoods v(s). A neighbourhood model based on a neighbourhood frame (S, u) is 
a triple (S, v, V) where V : At — > V(S) is a valuation function. 

Given a neighbourhood model M, a state s in M and an £-formula y>, we write M,s\= 
<p to denote that ip is true at s in M, and .M , s \/= tp, if 99 is not true at s in M. Truth of the 
atomic propositions is defined via the valuation: M, s \= pj iff s G ^(Pj), and inductively 
over the boolean connectives as usual. Truth of modal formulas is given by, 

M,s\=D<t> iff [<f>] M €u(s), (2.1) 

where [</>] = {t G S \ M,t \= <f\ denotes the truth set of (f> in M.. Let also M be a 
neighbourhood model. Two states, s in A4 and t in M, are modally equivalent (notation: 
M., s = M, t or simply s = t), if they satisfy the same modal £-formulas, i.e., s = t if and 
only if for all (p £ C: Ai, s \= ip iff A/, t \= ip. A subset X C 5 is modally coherent, if for 
all s,t G S such that s = t: s G X iff f E A" i.e., X is =-coherent. 

Let $ U {<^} C £. We write $ |= 99 if y is a /oca/ semantic consequence of $ over 
the class of all neighbourhood models, i.e., for any neighbourhood model A4 and state s 
in Ai, if A4,s \= $ then A^jS |= ip. In particular, if $ ^ _L then $ is called consistent, 
which means that $ is satisfiable in some neighbourhood model, and |= p means that p 
is valid in all neighbourhood models. We define classical modal logic E to be the theory 
of neighbourhood models, that is, for all /^-formulas p: ip G E iff |= ip. We will not be 
concerned with proof theory or axiomatics. For these matters, the reader is referred to |13j . 

The structure preserving maps between neighbourhood structures will be referred to as 
bounded morphisms. These have previously been studied in the context of algebraic duality 



and monotonic neighbourhood structures (which we define in Remark 2.7 below). 

Definition 2.5. If M.\ = (Si, v\, V\) and M.2 = (S2, ^2, V2) are neighbourhood models, and 
f: Si — > S2 is a function, then / is a (frame) bounded morphism from {Si,v\) to {S2, 1^2) 
(notation: /: {Si, u\) — > {S2, ^2)) if for all s G Si and all X C S , 2 : 

f~ l [X] G vi(s) iff Xev 2 (f(s)). (2.2) 

If also s G Vi(pj) iff f(s) G V2(pj), for all pj G At, and all s G Si, then / is a bounded 
morphism from Mi to M2 (notation: /: Mi — > A-^ 2 ). 

Bounded morphisms preserve truth of modal formulas. 

Lemma 2.6. Let Mi = (Si,vi,Vi) and M2 = (5*2,^2,^2) be two neighbourhood models 
and f : Mi — ► M2 a bounded morphism. For each modal formula ip £ £ and state s G Si, 
Mi,s\= ip iffM 2 ,f(s) \= ip. 



Proof. By a straightforward induction on the formula structure. Details left to the reader. D 
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Neighbourhood frames and bounded (frame) morphisms form a category which we de- 
note by NbhdFr. Similarly, neighbourhood models and bounded morphisms form a category 
Nbhd. This can easily be verified directly, but it also follows from the straightforward 
coalgebraic modelling of neighbourhood strcutures which we describe now. 

2.3. Coalgebraic modelling. We will work in the category Set of sets and functions. 
Let F: Set — ► Set be a functor. An F-coalgebra is a pair (X,£) where X is a set, and 
£: X — > F(X) is a function, sometimes called the coalgebra map. Given two F-coalgebras, 
(Xi, £1} and (X2, £2)) a function / : X\ — » X2 is an F -coalgebra morphism if F(/)o^ 1 = £ 2 o/, 
that is, the following diagram commutes: 

X x f -^x 2 

1 Hf) f 

FpTO -^i F(X 2 ) 

The category of F-coalgebras and F-coalgebra morphisms is denoted by Coalg(F). All no- 
tions pertaining to F-coalgebras are parametric in the functor F, but if F is clear from the 
context or immaterial, we will often leave it out and simply speak of coalgebras, coalgebra 
morphisms, and so on. Several examples of systems which can be modelled as coalgebras 
can be found in [391 SO] • 

The contravariant powerset functor 2: Set — > Set maps a set X to V(X), and a function 
/ : X — > Y to the inverse image function f- x [_] : V(Y) -► V{X). The functor 2 2 is defined 
as the composition of 2 with itself. That is, for any set X and any function f:X—>Y, 

2 2 (X) = V(V(X)), 

2 2 (f)(U) = {D C Y I f- l [D] G U} for all U G 2 2 (X). 

It should be clear that NbhdFr and Coalg(2 2 ) have the same objects. Similarly, given a 
neighbourhood model (S, is, V), we can view the valuation V : At — * V(S) in its transposed 
form V: S — > ^(At) where pj G V(s) iff s G V(j)j). It is now easy to see that (S,u,V) 
uniquely corresponds to a coalgebra (is, V) : S — > 2 2 (S) xP(At) for the functor 2 2 (— ) x"P(At). 
Moreover, it is straightforward to show that a function /: S\ — > S2 is a bounded morphism 
between the neighbourhood frames <Si = (Si,is\) and ^2 = (^2,^2) iff / is a coalgebra 
morphism from Si to £2- Similarly, 2 2 (— ) x"P(At)-coalgebra morphisms are simply the same 
as bounded morphisms between neighbourhood models. Hence NbhdFr = Coalg(2 2 ) and 
Nbhd = Coalg(2 2 (— ) x 'P(At)). From now on, we will switch freely between the coalgebraic 
setting and the neighbourhood setting. 

In the course of this paper, we will relate some of our results and definitions to existing 
ones for monotonic modal logic and normal modal logic. We briefly remind the reader of 
their definitions and their relationship with neighbourhood structures and coalgebras. 

Remark 2.7. A neighbourhood frame/model is monotonic, if for all s G S, the collection 
of neighbourhoods is(s) is upwards closed, i.e., if U C V and U G is(s) then V G is(s). 
Monotonic modal logic is the theory of monotonic neighbourhood models (cf. |13[ I20|). It 
was shown in [21] that monotonic neighboourhood frames are coalgebras for the subfunctor 
Mon of 2 2 which is defined by Mon(X) = {U G V(V(X)) \ U is upwards closed} on a set 
X. 
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Remark 2.8. It is well known that Kripke frames and their bounded morphisms can be 
seen as the category of coalgebras and coalgebra morphisms for the covariant powerset 
functor V: Set — > Set which maps a set X to the powerset V(X), and a function /: X — > Y 
to the direct image function /[_] : V(X) — ► V(Y). 

Kripke frames/models are in 1-1 correspondence with so-called augmented neighbour- 
hood frames/models (cf. [13J). A neighbourhood frame (S, v) is augmented, if it is mono- 
tonic and for all s £ S, f]u(s) £ v(s). In other words, in an augmented neighbourhood 
frame, each neighbourhood collection is the upwards closure of a unique, smallest neigh- 
bourhood. Given a Kripke model K, = (S,R,V), we obtain an augmented neighbourhood 
model /C aug = (S, v, V) , by taking v(s) = | R[s] for all s £ S. Conversely, given an aug- 
mented neighbourhood model M = (S, v, V), we define the Kripke model .M krp = (S, R, V) 
by taking R[s] = f] u(s) for all s £ S. It shold be easy to see that these transformations are 
inverses of each other. It is also straightforward to show that for any two Kripke models K,\ 
and /C2, a function is a Kripke bounded morphism from K,\ to /C2 iff / is a (neighbourhood) 
bounded morphism from to /C^ 118 . Hence the category of Kripke frames is isomorphic 
to the category of augmented neighbourhood frames. Moreover, a Kripke model tC and its 
corresponding augmented model /C aug are pointwise equivalent, i.e., for all states s in /C 
and any C- formula <p: K,, s \= (p iff /C aug , s \= ip. This can be proved by an easy induction 
on tp (cf. |13|). Normal modal logic is the logic of all Kripke models, or equivalently, of all 
augmented neighbourhood models. 

2.4. Basic constructions. Finally, we will need a number of technical constructions. Dis- 
joint unions of neighbourhood structures lift disjoint unions of sets to neighbourhood struc- 
tures such that the inclusion maps are bounded morphisms. Disjoint unions are instances 
of the category theoretical notion of co-products, and hence they satisfy a universal property 
(which we will use in several proofs). We give the concrete definition of disjoint unions neigh- 
bourhood models and their universal property, The definition for neighbourhood frames is 
obtained by leaving out the part about the valuations. 

Definition 2.9. Let Mi = (Si, fx, V\) and M2 = (S2, 1^2,^2) be two neighbourhood 
models. The disjoint union of Mi and M2 is the neighbourhood model A4\ + M2 = 
(S\ + S2,v, V) where for all pj £ At, V(j)j) = Vi(pj) + V2(pj); and for i = 1,2, for all 
X C 5*1 + 5*2, and s £ Sf. X £ v(s) iff X f] Si £ Vi(s). Mi + M 2 has the following uni- 
versal property: If N is a neighbourhood model and fj: Mj — > N, j = 1,2, are bounded 
morphisms, then there is a unique bounded morphism / : Mi + M2 — ► AA such that for 
j = 1, 2, fj = f o ij, where ij : Aij — ► Mi + M2 is the inclusion map. 

In the sequel we will also use coequalisers, pushouts and pullbacks. The general defini- 
tion of these notions can be found in any standard book on category theory (for example [2]). 
We are interested in particular instances of these notions in Set, and we therefore only give 
the concrete definitions using the well known constructions. We also give the universal 
property of coequalisers and pushouts, which we will also use. 

Definition 2.10. (coequaliser) Let fi, f% : X — > Y be a pair of functions. The coequaliser of 
fi and f2 in Set is the natural quotient map e: Y — > Y/R e where R = {(fi(x), f2(x) \ X)}. 
For any function g: Y — > Z such that go fi = go / 2 there is a unique function u: X/R e — » Z 
such that u o e = g. The coequaliser of a relation R C X x X is the coequaliser of its 
projections 7Ti, 7r 2 : R — > X. 



8 



H. H. HANSEN, C. KUPKE, AND E. PACUIT 



(pushout) Let R C X\ x X2 be a relation with projections tt\ : R — > Xi and 7T2 : i? — > X 2 . 
The pushout of R in Set is the triple (P,pi,p 2 ), where P := (Xi+X 2 ) /P 12 , -R12 = PA7+X2 = 
{(tl(zi), i 2 (x 2 )) I (si, £2) G P}, £'• X\ + X2 — » (Xi + X 2 )/Pf 2 i s the coequaliser of 11 o 7ri 
and i 2 o 7T2, and p« = e o ij, i G {1,2}. The construction is illustrated in Figure [TJb) . 
Moreover, if P', p\ : Y\ — > P' and p' 2 : I2 - ► P' ar e such that o tt\ = p' 2 o 7r 2 , then there 
exists a unique function n: P — > P' such that p'j = u o p\ and p' 2 = u o p 2) as illustrated in 
Figure Qc). 

(pullback) Let /1 : Xi — > 1" and / 2 : X 2 — ^ 1" be functions. The pullback of f\ and / 2 
in Set is the triple (pb(/i, / 2 ), 7ri, 7r 2 ), where pb(/ 1? / 2 ) := {(a? 1 ,x 2 ) G X\ x X 2 | = 
72(^2)}; and tti : pb(/i, / 2 ) — > Xi and 7r 2 : pb(/i, / 2 ) — > X 2 are the projections. 

Coproducts and coequalisers are a special form of colimit. It is known that for any 
functor F: Set — * Set, all colimits exist in Coalg(F) and they are constructed essentially 
as in Set, see |39| Section 4.4]. We have already seen how this works for coproducts. For 
coequalisers, it means that the coequaliser of two F-coalgebra morphisms fi,f2- (X, f) — > 
(y, 7) in Coalg(F) is the same map e: Y — » Y/R e which is the coequaliser of f\ and / 2 in 
Set, and there is a coalgebra structure A: Y/R e — > F(Y/R e ) such that e is an F-coalgebra 
morphism from (Y, 7) to (Y/R e ,X). 



Figure 1: Coequalisers and Pushouts. 




3. Equivalence notions 

In this section we will study various notions of "observational equivalence" for neigh- 
bourhood frames in detail. In the first part we list the three coalgebraic equivalence notions 
that we are going to consider. In the second part we work out in detail what these three 
equivalence notions mean on neighbourhood frames. 

3.1. Three coalgebraic notions of equivalence. The main observation for defining 
equivalences between coalgebras is that coalgebra morphisms preserve the behaviour of 
coalgebra states. This basic idea motivates the well-known coalgebraic definitions of bisim- 
ilarity and behavioural equivalence. In the following F denotes an arbitrary Set functor. 



NEIGHBOURHOOD STRUCTURES: BISIMILARITY AND BASIC MODEL THEORY 



9 



Definition 3.1. Let (Xi,£i) and (^2,^2) be F-coalgebras. 

(1) A relation R C X\ XX2 is an (F-)bisimulation between (Xi,£i) and {X2,£,2), if there 
exists a function p: R — > F(i?) such that the projections 7Tj: — > Xi are F-coalgebra mor- 
phisms from (R, p) to (Xj,£), i G {1,2}. Two states x\ and X2 are (F-)bisimilar (notation: 
x\ t± X2), if they are linked by some F-bisimulation. The relation t± is called F-bisimilarity. 

(2) Two states x\ G Xi and X2 G X2 are behaviourally equivalent (notation: x\ t±& X2), 
if there exists an F-coalgebra (^,7) and F-coalgebra morphisms (Xj,£j) — ► (1", 7) for 
i = 1,2 such that f\{x\) = f2{x?). The triple ((Y,7), /1, /b) is called a cocongruence 
between (Xi,£i) and (X2,£,2)- If ((^7)5/15/2) is a cocongruence, then we also refer to 
i? = pb(/i,/2) as a cocongruence between (Xi,£i) and (X2,^)- The relation t±6 is called 
behavioural equivalence. 

Remark 3.2. Cocongruences were introduced by Kurz in [26]. In loc.cit., Kurz refers to 
(the kernel of) an epimorphism as a behavioural equivalence. We have chosen to follow 
the terminology of [TJ [19] and use the word congruence for kernels. We reserve behavioural 
equivalence to denote the equivalence notion associated with congruences and cocongru- 
ences. 

For any functor F, F-bisimilarity implies behavioural equivalence (this fact will also fol- 



low from Proposition 3.10). However, the converse only holds if F preserves weak pullbacks. 
Precongruences were introduced in [1] as an alternative to bisimulations for functors that 
do not preserve weak pullbacks. 

Definition 3.3. Let {X, £} be an F-coalgebra and R C X x X a relation. R is a congruence 
on (X, £) if the coequaliser e: X — > X/R of R is an F-coalgebra morphism, i.e., there exists 
a unique coalgebra structure A: X/R — ► F(X/R) such that e is a coalgebra morphism from 
(X,£) to (X/R,X). We call {X,£)/R := {X/R, A) the quotient of {X,£) with R. R is a 
precongruence on (X, £) if i? e is a congruence. 

Since any F-coalgebra morphism / : (X, £) — ► ( Y, 7) factors through X/ ker(/) , it follows 
that R is a congruence on (X, £) iff R = ker(/) = pb(/, /) for some F-coalgebra morphism 
f:(X,0^(X',e). 

Lemma 3.4. Let (X, £) 6e an F-coalgebra. Behavioural equivalence, the largest congruence 
and the largest precongruence on (X, £) a// coincide. 

Proof. The lemma follows from results in [1] and |19[ Lemma 5.10], but we also provide a 
quick argument here. Clearly, a congruence is also a precongruence and a precongruence 
is contained in a congruence. Hence the largest congruence is the largest precongruence. 
We refer to [1] for more details. Similarly, a congruence is clearly a cocongruence, and any 
cocongruence is contained in a congruence, since the category of F-coalgebras has coequalis- 
ers: if R = pb(/i, ^2) for F-coalgebra morphisms f%, fi '■ X — > Y, then R C ker(eo/ 1 ), where 
e is the coequaliser of f\ and f%. See also [191 Lemma 5.10]. Hence the largest congruence 
is behavioural equivalence □ 

Precocongruences can be seen as a generalisation of precongruences to relations between 
coalgebras obtained by replacing coequalisers by pushouts. 
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Definition 3.5. Let (Xi,£i) and (X 2 ,£ 2 ) be F-coalgebras, and let R C X\ x X2 be a 
relation with pushout (P,pi,p2). The relation R 
is called a precocongruence between (Xi,£i) and 
(^2, £2)) if there exists a coalgebra map A: P — ► 
F(P) such that the pushout maps pi : Xi — > P and 
P2 : X2 — > P are F-coalgebra morphisms, i.e., the di- 
agram on right commutes. In other words, R is a 
precocongruence if and only if its pushout (P,pi,p 2 ) 
is a cocongruence. If two states x\ and x 2 are related by some precocongruence, we write 

X\ t± p X2- 

The following lemma tells us that we can think of precocongruences as the relations 
that are precongruences on the coproduct (disjoint union), and it provides a useful criterion 
for proving that a relation is a precocongruence. 

Lemma 3.6. Let (Xi,£i) and (X 2 ,£ 2 ) be F-coalgebras, and let R C X\ x X2 be a relation 
with pushout (P,pi,p2). The following are equivalent: 

(1) R is a precocongruence between (Xi,£i) and (X2,£2)- 

(2) F(p 1 ) o £ x o TTi = F(p 2 ) 6 7T2, ie., P C pb(F(pi) o £ l5 F(p 2 ) 6)- 

(3) Rx 1 +x 2 * s a precongruence on (Xi,£i) + (X2,£2)- 



Proof. (1 44> 2): Item 2 holds iff the outer part of the diagram in Def. 3.5 commutes, so 
the implication (1 2) is immediate. Conversely, if item 2 holds, then by the universal 
property of the pushout (P,pi,p 2 ) there is a (unique) function A: P — > F(P) such that 
A o p 1 = F(pi) o ^ and Aop 2 = F(p 2 ) o £ 2 . Hence P is a precocongruence, 

(1 =4> 3): If the pushout maps are morphisms, there exists by the universal property of 
the disjoint union (Xi,£i) + (X 2 ,£2) i n Coalg(F), a unique F-coalgebra morphism u: X\ + 
X2 — > P such that pi = uo l { , % G {1, 2}. By the definition of the pushout (cf. Figure pjb)), 
it must be the case that u is equal to the natural quotient map e : X\ + X2 — > P, and hence 
Rx 1 +x 2 is a precongruence. 

(3 =^ 1): If Rx 1 +x 2 i s a precongruence on the disjoint union, then the quotient map 
e: X\ + X2 — ► (Xi + X2)/P3 (:i+ x 2 is an F-coalgebra morphism. Since Pi = e o t i} % G {1, 2}, 
and the canonical inclusions : Xj — > Xi + X2, i G {1,2}, are also F-coalgebra morphisms, 
it follows that the pushout maps are F-coalgebra morphisms. □ 

An interesting property of precocongruences, is that, like bisimulations, they can be 
characterised by a form of relation lifting. 

Definition 3.7. Let R C X\ x X2 be a relation and let (P,pi,p 2 ) be the pushout of 
(P, 7ri, 7r 2 ). We define the F-lifting Lif{F){R) C F(Xi) x F(X 2 ) of P by 

Li/(F)(P) :=pb(F( Pl ) ) F(p 2 )). 

Note that Lif{F) is independent of the concrete representation of the pushout. This 
follows easily from the fact that pushouts are unique up-to isomorphism. The definition of 
Lif(F) goes back to an idea by Kurz (|25j) for defining a relation lifting of functors that do 
not preserve weak pullbacks. 

Lemma 3.8. Let (Xi,£i) and (X 2 ,£ 2 ) be F-coalgebras, and let R C X\ x X2 be a relation. 
R is precocongruence iff for all {x\,X2) G R: (£1(^1), £2(^2)) S Lif{F){R). 



Proof. Immediate from Lemma 3.6 and the definition of Lif(F). □ 
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The characterisation of precocongruences in Lemma 3.8 makes it easy to show that 
between any two coalgebras, there exists a largest, and necessarily unique, precocongruence. 
First, note that for any relations R' C P C X\ xX 2 with pushouts (P',p'i,p 2 ) and (P,pi, P2), 
respectively, there exists by the universal property of P' a unique map u : P' — > P such that 
Pi =uop' i , i G {1,2}. Consequently, F(pi) = F(u) o F(p' i ), i G {1,2}, and for all t\ G F(Xi), 
t 2 € F(X 2 ): F(pi)(ti) = F(p' 2 )(t 2 ) implies that F(pi)(ii) = F(p 2 )(t 2 ). Hence, 

R' CR Lif(F)(R') C Lif{F){R). (3.1) 

Lemma 3.9. Let and (X 2 ,£ 2 ) F -coalgebras. The union of all precocongruences 

between and (X 2 ,£ 2 ) is again a precocongruence. 

Proof. Let P be the union of all precocongruences between and (X 2 ,£ 2 )j and 

(P, Pi,p 2 ) the pushout of P. If (xi,x 2 ) G P, then there is a precocongruence P' C 
R such that (a^i,^) G R' . Letting (P , ,p' 1 ,p' 2 ) be the pushout of R', it follows that 
<£l(*l), 6M) G Lif(F)(R'), and hence by @ that (Ci(xi), 6(^2)) G Lif(F)(R). We 
conclude by Lemma |3.8| that P is a precocongruence. □ 

In the following proposition we give a first comparison between precocongruences, bisim- 
ulations and cocongruences. 

Proposition 3.10. Let and (X 2 ,£ 2 ) 6e F-coalgebras, and let R be a relation between 

X\ and Xi- 

(1) If R is a bisimulation, then R is a precocongruence. 

(2) If R is a precocongruence, then R is contained in a cocongruence. 
Consequently, for all X\ G X\ and x 2 G X 2 : 

x\ t± X2 implies x\ t± p x 2 implies x\ t±b %2- 

Proof. Let R C Xx x X2 be a relation with projections ix\ : P — > X\ and 7r 2 : R — > X 2 , and 
pushout (P,pi,p 2 ). Item 1: Assume P is a bisimulation. By composing the projections with 
the canonical inclusion morphisms into the coproduct, we have a pair of parallel F-coalgebra 
morphisms ti07Ti, t 2 07r 2 : P — > Xl+X 2 . The quotient map e : X1+X2 — > (Xi-I-X^/P^^ , 
is now the coequaliser of ti07ri and i 2 o7r 2 in Coalg(F), hence an F-coalgebra morphism. Since 
Pi = eoij, i = 1, 2, pi and p 2 are F-coalgebra morphisms. Item 2: If P is a precocongruence, 
then the pushout maps p% and p 2 are F-coalgebra morphisms. The claim now follows from 
the fact that P C pb(pi,p 2 ). □ 

Proposition |3.10| alone does not yet tell us whether precocongruences are a better ap- 
proximation of behavioural equivalence than F-bisimulations, but in the next subsection, 



we will see that, in general, the implications of Proposition 3.10 are strict. The following 



lemma provides us with a criterion which ensures that a cocongruence is a precocongruence. 

Lemma 3.11. If and (X 2 ,£ 2 ) are F-coalgebras and R C X\ x X 2 is a bitotal 

cocongruence between and (X 2 , £ 2 ), then R is a precocongruence. 

Proof. Let P be a cocongruence with projection maps m : P — > Xi and 7r 2 : P — > X 2 and 
pushout (P,pi,p 2 ). Then there exist an F-coalgebra (1", 7) and F-coalgebra morphisms 
fi'. X{ — > Y for i G {1,2} such that P = pb(/i,/ 2 ). We are going to define a function 
A: P — > F(P) such that pj is an F-coalgebra morphism from to (P, A) for j G {1,2}. 
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By the universal property of the pushout there has to be a func- 
tion j : P — > Y such that j o p, = /, for i G {1,2}, as shown in 
the diagram to the right. We claim that this function is injective. 
First, it follows from the definition of the pushout that both pi 
and p2 are surjective, because P is bitotal. Let now Zi,Z2 G P 
and suppose that j(zi) = j(z2)- The surjectivity of the p^s im- 
plies that there are si G X\ and S2 G X2 such that pi(si) = Zi 
andp2(s2) = Z2- Hence j(pi(si)) = j(p2(s2)) which in turn yields 
/i( s i) = f2(s2}- This implies that (51,52) G -R and consequently, 

Pi(si) = P2(s2)j i-e., z\ = Z2. This demonstrates that j is injective and thus there is some 
surjective map e: Y — > P with eoj = idp. Now define A := F(e) o\oj. It is straightforward 
to check that for i G {1, 2}, the function pj : (Xi, £«) — > (P, A) is an F-coalgebra morphism. □ 

We will now show that on a single F-coalgebra, an equivalence relation is a precocon- 
gruence iff it is a congruence. It then follows immediately that the largest congruence is a 
precocongruence. 

Theorem 3.12. Let (X,£) an F-coalgebra. 

(1) If R C X x X is an equivalence relation then: R is a precocongruence on (X,£) iff R 
is a congruence on (X, £). 

(2) For all x\^x% G X: x\ t±& X2 ijff xi t± p X2. 

Proof. To prove item 1, first, observe that if R C X x X is an equivalence relation, then 
(x, x) G R for all hence pi(x) = P2(x) for all x £ X, i.e., pi = p2- It follows that the 

pushout of R is of the form (P,p,p) and P = ker(p). Hence if P is also a precocongruence, 
then p is a coalgebra morphism and P = ker(p) is a congruence. Conversely, if P is a 

a 



congruence, then P is clearly a bitotal cocongruence on (X, £) and so by Lemma 3.11 



precocongruence. Item 2 of the lemma follows from item 1 and Lemma 3.4 



□ 



We have introduced precocongruences as a generalisation of precongruences to relations 
between different coalgebras. However, we point out that this generalisation is conceptual 
rather than set-theoretic, since on a single coalgebra, a precongruence is not necessarily 



a precocongruence (as we will see in Example 3.18 below). In fact, one might say that 



precocongruences specialise precongruences in the one-coalgebra case, since the converse 
does hold. 

Lemma 3.13. Let (X,£) be an F-coalgebra and SCIxI. If R is a precocongruence on 
(X,£), then R is also a precongruence on (X,£). 

Proof. Let (P,pi,P2) be the pushout of P, and let er: X — > X/R e be the natural quotient 
map (i.e., the coequaliser of P). By the universal property of the pushout in Set, there is a 
unique map u: P — > X/R e such that u o p\ = sr = u o p 2 . It follows that F(u) o F(pi) = 
F(er) = F(it) o F(p2), and hence for all x,y G X: F(pi)(£(x)) = F(p2)(£(y)) implies that 
F(£r)(£(x)) = F(er)(£(2/)). Consequently, using Lemma [3.6[ 2) and the fact that P is a 
precongruence iff P C ker(F(e^) o £) (this can easily be shown using the universal property 
of coequalisers, see also p~|), we conclude that if P is a precocongruence, then P is also a 
precongruence. □ 



NEIGHBOURHOOD STRUCTURES: BISIMILARITY AND BASIC MODEL THEORY 



13 



3.2. Equivalences between neighbourhood frames. In this subsection, we will inves- 
tigate behavioural equivalence, bisimilarity and the equivalence notion arising from preco- 
congruences over 2 -coalgebras, i.e., neighbourhood frames. First, we obtain set-theoretic, 
back- and- forth style predicates for 2 2 -bisimulations and 2 2 -precocongruences. Next, we pro- 
vide examples which show that the implications from Proposition |3. 10 are strict. However, 



we also show that on a single neighbourhood frame all three equivalence notions coincide. 
Finally, we compare the three equivalence notions with bisimulations over monotonic neigh- 
bourhood frames and Kripke frames. 

Remark 3.14. For simplicity of presentation, we have chosen to only treat equivalence 
notions on neighbourhood frames, but the results of this section can easily be extended to 
neighbourhood models, i.e., 2 2 (— ) x "P(At)-coalgebras. For example, working out the details 
of the definition of 2 (— ) x "P(At)-bisimulation results in the expected characterisation: A 
relation R is 2 (— ) x "P(At)-bisimulation and if and only if R is a 2 2 -bisimulation and for 
all {s, t) G R, s and t satisfy the same atomic propositions. Similar statements hold for 
cocongruences and precocongruences. 



Let us start out by considering 2 2 -bisimulations. Recall from Def. 3.1 that a relation 
R Q Si x 5*2 is a 2 2 -bisimulation between two 2 2 -coalgebras Si = (Si, vi) and £2 = (S2, ^2) if 
the projection maps 7ri and 7T2 are bounded morphisms (2 -coal gebr a morphisms) from some 
2 2 -coalgebra (R,n) to Si and 52 respectively. By Definition 2.5 of a bounded morphism 
this means that for (s\, S2) G R and i = 1,2: 

U G Vi{ Si ) iff vr" 1 ^] G fi(( Sl , 8 2 )) for U C 5*. 

This leads to two "minimal requirements" on the neighbourhood functions v\ and V2 for 
pairs (si, S2) contained in a 2 2 -bisimulation. For all Ui, \J[ C Si, i = 1,2: 

(1) n^lUi] = n^pi] implies U t G ufa) iff U[ G ufa), 

(2) TT^Ui] = Tr^C/s] implies U x G ^i(si) iff U[ G u 2 (s 2 ). 

Using the notion of incoherence we can reformulate the previous requirements and 
prove that they in fact characterise 2 2 -bisimulations. 

Proposition 3.15. Let Si = (Si,ui) andS2 = (£2, 2^2) be neighbourhood frames. A relation 
R C Si x S2 is a 2 2 -bisimulation between Si and S2 iff for all (si, S2) G R, for all Ui,U[ C Si 
and for all U2, U'^ C 52 the following two conditions are satisfied: 

(1) (a) if dom(R) n Ui = dom(R) n U{ then Ui G i>i(si) iff U[ G vi{si), and 
(b) if rng( J R) n U 2 = rng( J R) n XJ' 2 then U 2 G ^ 2 (s 2 ) iff G ^ 2 (s 2 ). 

(2) if the pair (C7x, Z/2) is R-coherent, then: Ui G i'i(si) iff U2 G 1^2(52)- 

Proof. It is a matter of routine checking that every 2 -bisimulation R fulfills conditions 1 and 
2. Let now R C Si x ^2 be a relation that fulfills the conditions 1 and 2 for all {si, S2) G R. 
We define the neighbourhood function fi: R — > 2 2 (R) by /i((si,S2)) := { 7r r 1 [^ r ] I ^ e 
vi (si)} U {vr 2 ^ 1 [y] I V G ^2(52)}- In order to show that R is a 2 2 -bisimulation it suffices to 
prove that for i = 1,2 the projection functions Hi : (R, fx) — > Si are bounded morphisms. 
We only provide the details for the proof that 1x1 is a bounded morphism. We have to 
demonstrate that for all (si, S2) G R and all ?7 C Si we have 

!/6^i(si) iff TrfV] €M«si,«2». (3-2) 
Let (gj, §2) G ii and J7 C 5i. By definition of /x((si,S2}) the di rect ion from left to right in 



(3.2) is immediate. In order to prove the other implication in (3.2) suppose that Tr^p] G 
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/J-((si,s 2 )) for some U C S%. According to the definition of fi((si,s 2 }) the following cases 
can occur: 

Case: ^[U] = ^ l [U') for some U' G fi(si). Then dom(P) nU = dom(P) fW and hence 

U must be also in v\ (si) by condition 1 of the proposition. 
Case: ^[U] = tt 2 1 [V] for some V G ^(si), i.e., the pair (U,V) is P-coherent. Condition 

2 therefore yields U G ^1(52) as required. □ 



Another way of formulating condition la in Proposition 3.15 , is to say that if U± G ^i(si) 
and U[ £ vi(s\), then there is a u G (U\ \ U[) U (U[ \ U\) such that u G dom(P). Similarly 
for condition lb. Informally, one can say that condition 1 requires that the relation R 
must witness the difference between subsets when one is a neighbourhood and the other is 
not. We will now show that precocongruences are characterised by condition 2 only, hence 
condition 1 is unnecessary (unwanted even) for the purpose of approximating behavioural 
equivalence. 

Let (Si, v\) and (S2, V2) be two 2 2 -coalgebras and R C Si x S2 a relation with pushout 
(P, pi , P2) ■ We have : 

R is a precocongruence 

iff V(si, s 2 > G R : 2 2 (pi)(^(si)) = 2 2 {p 2 ){v 2 {s 2 )) 

iff V(si,s 2 > G R.W C Pr^V] e ^i(si) ^ pJ x [V] G ^ 2 (s 2 ) (3.3) 
We now show that, in fact, ( |3.3[ ) is equivalent with condition 2 of Proposition 3.15| 

Proposition 3.16. Let S\ = {S\,v\) and S 2 = (S 2 ,i , 2 ) be neighbourhood frames, and 
R Q Si x S2 a relation. We have: R is a precocongruence between Si and S 2 if and only 
if for all (si,s 2 ) G R and for all U\ C Si and U 2 C S2 such that (U\,U 2 ) is R-coherent: 
Ui G iffU 2 G u 2 {s 2 ). 

Proof. Let Si,S 2 and P be as stated. Furthermore, let 7Tj : P —* Si, i G {1,2}, be the 
projections of P, R\ 2 = Ps 1+ 5 2 , and {P,pi,p 2 ) the pushout of R. We will prove that for all 
Ui C Si and *7 2 C S 2 : 

<C/i,l7 2 > is P-coherent iff U x = p^Y] and f/ 2 = P 2 1 [Y] for some Y C P. (3.4) 



The proposition then follows from (3.3) and (3.4). To prove the direction from left to right 



in (3.4), assume U\ C S 2 , E/jj C S2 and (Ui,U 2 ) is P-coherent. From Lemmas 2.2 and 2.3 
we get that U\ + U 2 is Pf 2 -coherent. Let e: Si + S2 — > P be the quotient map associated 
with Pf 2 - We claim that we can take Y = e[t/i + U 2 ], the set of Pf 2 -equivalence classes 
intersecting U\ + {7 2 - To see that p ] ^ 1 [e[L r i + U 2 ]] = TJ\ and p 2 1 [e[Ui + U 2 ]] = U 2 , we have 
for all i G {1,2} and Sj G S«: 

Si G pr 1 [£[{/! + U 2 ]\ <=> Pi(s-i) G £[J7i + L^] 

<=> 3s' G C/1 + C/2 : <«i,s') G Pf 2 
(C/i + % flf 2 -coh.) <^ Si G C/i + J7 2 

Si G J7i- 



To prove the direction from right to left in (3.4), let Y C P be arbitrary. We have for all 
(si,s 2 ) G P: 

{8i,s 2 ) G vrr 1 ^ 1 ^]] iff Pi(«l) G Y iff p 2 (s 2 ) G Y iff (si,s 2 ) G ^[^[Y]]. 
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where the middle equivalence follows from the fact that (si,s 2 ) £ R impl ies p \{s\) = 
^2(52)- We have now shown that vr^~ 1 [p 1 " 1 [y]] = ir^ 1 ^ 1 \X]], hence by Lemma 2.2 the pair 
{Pi 1 [ Y ]iP2 1 i Y }) is ^-coherent. □ 
Since we know that on a single coalgebra, congruences are precocongruences (Theo- 



rem 



3.12), we get the following characterisation. 

Corollary 3.17. Let (S, v) be a neighbourhood frame and R C SxS an equivalence relation. 
We have: R is a congruence on (S, v) iff 

for all (si,s 2 ) G R and all R-coherent U C S: U £ f(si) iff U £ v(s 2 ). (3-5) 

Proof. Let R C S x S be an equivalence relation. We first prove a small claim: Claim: A 
pair {Ui,U 2 ) is incoherent iff U% = XJ 2 = U for some incoherent subset U C S. Proof of 
Claim: Recall that a pair (Ui,U 2 ) is incoherent iff R\U\] C U 2 and R~ 1 \L J 2\ Q U\. Since 
R is an equivalence relation, R is reflexive, and it follows that if (Ui,U 2 ) is i?-coherent, 
then C7i C C LT 2 and U 2 C /r -1 ^] C C7i, hence C7i = Conversely, if C7 is some 

i?-coherent subset of S, then by definition, (U, U) is i?-coherent. 

We now have: R is a congruence iff (Thm. 3.12 ) R is a precocongruence iff (Prop. 3.16| ) 
for all (51,^2) £ -R and for all U\,Ui C 5 such that (Ui, t/2) is -R-coherent: f/i G ^(si) iff 
^2 S ^(52)- Using the above claim, this last statement is equivalent with ( |3.5| ). D 

We will now demonstrate with two examples that 2 2 -bisimilarity, precocongruences 
and behavioural equivalence differ on neighbourhood frames. It is tempting to think of the 
elements of neighbourhoods as successor states, but these examples show that this leads 
to wrong intuitions. For example, contrary to the intuition we have from Kripke bisimu- 
lations, behavioural equivalence in neighbourhood frames does not require that nonempty 
neighbourhoods are somehow matched by nonempty neighbourhoods. Moreover, states that 
are not contained in any neighbourhood of some state s, can influence the existence of a 
bisimulation or cocongruence at s. 

Example 3.18. Consider the two neighbourhood frames, T = (T,i>t) and S = (S,vs) 
where T = {t u t 2 ,t 3 }, v T {t x ) = u T (t 2 ) = {{t 2 }}, v T (t 3 ) := {0}, and S = {s}, u s (s) = 0. 
The two states t\ and s are behaviourally equivalent. To see this, let IA = {U,vu) be the 
neighbourhood frame where U = {ui,u 2 }, fu( u i) = anci ^u(u 2 ) = {0}. Let f\ : T — ► 
U and f 2 : S — > U be the functions with graphs Gr(/i) = {{t\, Ui), {t 2 , ui), (£3, u 2 )} and 
Gr(/2) = {(s,ui)}, respectively, as illustrated in the following picture: 







r 






• 
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h .... 
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It can easily be verified that f\ and f 2 are bounded morphisms. For example, the 



bounded morphism condition (2.2) holds for f\ at t\ and t 2 , since their only neighbourhood 
{t 2 } is not the inverse /i-image of any subset of U. Since fi(t\) = f 2 (s), t\ and s are 
behaviourally equivalent. In fact, R := pb(/i,/2) = {(ti, s) , (t 2 , s)} is a precocongruence. 
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This can be verified using the characterisation given in Proposition 3.16 Note that there 
is no subset U C S such that ({£2}, U) is i?-coherent. 

However, t\ and s are not 2 2 -bisimilar. For suppose R is a 2 2 -bisimulation between 
T and S, then (ts,s) ^ R, since (0,0) is .R-coherent, G vt{H) and ^ vs(s). Hence 
t% ^ dom(i?), and it follows that dom(i?) n fa} = dom(i?) n fa,h}. Now, since fa} G 
z^r(fi) and {£2^3} ^T^ti), we can conclude from condition la of Proposition 3.15 that 



ti cannot be i?-related to any state in S, in particular not to s. Since R was an arbitrary 
2 2 -bisimulation, t\ and s are not 2 2 -bisimilar. 

Consider, now the relation R' = {(^,£2)} ° n the neighbourhood frame T. The reader 
can check that R' is a precongruence, but not a precocongruence, on T. 

The above example shows that between neighbourhood frames, preco congruences are 
a better approximation of behavioural equivalence than 2 2 -bisimilarity. However, the next 
example shows that also precocongruences cannot capture behavioural equivalence, in gen- 
eral. 



Example 3.19. We consider now a small variation on the picture given in Example 3.18 
The neighbourhood frames S, IA and the function fa are the same as before, but on T 
we now take as neighbourhood function v' T (t\) = {{£2}}, vlffa) = v' T {t^) = {0}, and let 
T = (T, i/ T ). Instead of the function fa, we take the function f[: T — > U with graph 
Gr(/{) = {{ti, ui), (t2, U2), (£3, «2)}- Again, it is straightforward to check that f[ is a 
bounded morphism, and hence ti and s are behaviourally equivalent. 

U S 




"2 



Ml 




However, there is no precocongruence containing the pair {t\, s). Suppose R' QT x S 
is an arbitrary precocongruence between T and S. Since (0,0) is /^'-coherent, G v' T {t2) 
and ^ vs{s), it follows from Proposition 3.16 that {t2,s) -R'. This implies that ({i2} 5 0) 
is iJ'-coherent, but fa} G f^(ti) and ^ ^s(s), so (ti,s) G" R'. 



To sum it up: Example 3.18| showed that prec ocongruences are a clear improvement 



3.19 



however, demonstrates that precocon- 



when compared to 2 2 -bisimulations. Example 
gruences are still incomplete as a proof principle for behavioural equivalence over neigh- 
bourhood frames. 



From Theorem 3.12 of the previous subsection, we know that on a single neighbourhood 
frame, precocongruences do capture behavioural equivalence. Using the results of this 
subsection it follows easily that, in fact, also 2 -bisimilarity captures behavioural equivalence 
on a single structure. 

Proposition 3.20. If S = (S, v) is a neighbourhood frame, and R C S x S is an equivalence 
relation, then: 

R is a 2 -bisimulation iff R is a precocongruence iff R is a congruence. 
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Consequently, for all si,s 2 £ S: s\ t± s 2 iff s± t±p s 2 *if si —6 ^2- 

Proof. If i? C S 1 x S is an equivalence relation, then in particular dom(i?) = rng(i?) = S, 



isations in Propositions 3.15 



and hence condition 1 o f Pro posi tion 3.15 is trivially satisfied. It follows from the character- 

and 3.16 that R is a 2 2 -bisimulation iff R is a precocongruence. 

The final 



The second equivalence is an instance of the more general result in Theorem 3.12 



claim is an immediate consequence of the main claim and Lemma 3.4 



□ 



Remark 3.21. Alternatively, Proposition 3.20 follows from the result in [19 that congru- 
ences are F-bisimulations in case the functor F weakly preserves kernel pairs - a property 
that the functor 2 2 has as the following argument shows: Let / : 5 — > T be a function and 
consider its kernel ker(/) := {(s, s') £ Sx S \ f(s) = f(s')} with projections 7Tj : ker(/) — ► S 
for i = 1, 2. We have to show that for every pair of sets N±, N 2 £ ker(2 2 (/)) there exists a set 
N £ 2 2 (ker(/)) such that 2 2 (^)(iV) = JVj for i = 1,2. Let N u N 2 be elements of 2 2 {S) such 
that 2 2 (/)(iV 1 ) = 2 2 (/)(iV 2 ). We put N := {^{Ux) \ V x £ iV x } U {k 2 1 {U 2 ) \ U 2 £ iV 2 }. It 
is now easy to check that 2 2 (-Ki)(N) = Ni for i = 1, 2 as required. 



4. Hennessy-Milner classes 

The Hennessy-Milner theorem for normal modal logic states that over the class of 
finite Kripke models, two states are Kripke bisimilar if and only if they satisfy the same 
modal formulas. It is well known (see e.g. |10|). that this Hennessy-Milner theorem can be 
generalised to hold over any class of modally saturated Kripke models, in particular, over 
the class of image-finite Kripke models. 

In this section, we define modal saturation and image-finiteness for neighbourhood 
models and show that each of these properties leads to a Hennessy-Milner style theorem. 
In the last subsection we describe ultrafilter extensions of neighbourhood models, and show 
that they are modally saturated. 

First, we make precise what we mean by a Hennessy-Milner class of neighbourhood 
models. Since we have three equivalence notions for neighbourhood models, we have, in 



principle, three types of Hennessy-Milner classes. However, Examples 3.18 and 3.19 of sec- 



tion [3] showed that even over the class of finite neighbourhood models, two states can be 
behaviourally equivalent, and hence modally equivalent, without being linked by a preco- 
congruence or a bisimulation. This means that precocongruences and bisimulations do not 
fit well with the expressivity of the modal language. We therefore define Hennessy-Milner 
classes with respect to behavioural equivalence. 

Definition 4.1. A class K of neighbourhood models is a Hennessy-Milner class, if for any 
Mi and M 2 in K containing states si and s 2 , respectively, we have: Mi, si = M 2 , s 2 iff 
Mi, 8! t± b M 2 ,s 2 . 

The following lemma provides an easy, but useful, criterion for proving that a class of 
models is a Hennessy-Milner class. 

Lemma 4.2. Let K be a class of neighbourhood models. If for any Mi,M 2 £ K, the modal 
equivalence relation = is a congruence on Mi + M 2 , then K is a Hennessy-Milner class. 
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Proof. Let Mi and M2 be neighbourhood models in K, and let tj: Mi — > «Mi + .M2 
denote the canonical inclusion morphisms. As- 
sume that we have states s\ and s 2 such that — _ — ^ Mi + M2 < — - — M2 
Mi, s\ = M.2, S2- Since truth is invariant under 

bounded morphisms, we have ti(si) = 1*2(82) m , £ 

M\ +M2- By assumption, = is a congruence on (Mi + -M 2 )/= 

M1+M2, hence e: M1+M2 -> (-Mi+-M 2 )/= 

is a bounded morphism (as illustrated by the diagram), and (si, s 2 ) G pb(eoti, eot, 2 ), hence 

si t±b s 2 . □ 



4.1. Modally saturated models. In Lemma 4.2 we saw that in order to prove a Hennessy- 
Milner theorem, we are interested in neighbourhood models on which modal equivalence is 
a congruence. Let M = (S, v, V) be a neighbourhood model. By applying the characterisa- 



tions of congruences on neighbourhood frames in Corollary 3.17 and adding the condition 
for the atomic propositions, we find that = is a congruence on M iff for all s,t G S such 
that s = t: 

(cl) for all p G At : s £ V(p) <^=>- t G V(p), and , , 

(c2) for all modally coherent ICS: X G u(s) X G u(t). ^ ' ' 

Clearly, condition (cl) holds in all neighbourhood models, since modally equivalent 
states must make the same atomic propositions true. One way of making condition (c2) 
hold, is to ensure that all modally coherent neighbourhoods are definable. 

Lemma 4.3. Let M = (S, v, V) be a neighbourhood model. If for all s G S and all modally 
coherent X G v(s), there exists a modal C-formula ip such that X = l^p} M , then modal 
equivalence is a congruence on M. 

Proof. Let X be a modally coherent neighbourhood of some state, and assume X = fipj . 
We have for any s,t G S such that s = t: X G v(s) iff M,s \= D(p iff M,t \= Dtp iff 
X£u(t). ' ' □ 

For finite models, a standard argument shows that any modally coherent neighbour- 
hood X is definable by a formula of the form 5 = \/ i<n Aj<fc w bere n,k < u. For 
infinite models, the same argument would yield a formula with an infinite disjunction and 
conjunction, which is not a well-formed formula of our unitary language. Modal saturation 
is a compactness property which allows us to replace infinite conjunctions and disjunctions 
with finite onesQ Thus we can essentially use the same argument as in finite models to show 



that modally coherent neighbourhoods are definable (and we do so in Lemma 4.5 below). 
We will use the following notation. Let \& be a set of modal ^-formulas and M = (S, v, V) 
a neighbourhood model. We define = {->tp \ G *}, [A^l^ = fl^tM^i and 
[V*]^ = U^ G *M^- A set * of ^-formulas is satisfiable in a subset X C S of M, if 
[A H X ^2 0. A set $ of C- formulas is finitely satisfiable in X C S, if any finite subset 
^0 * is satisfiable in X. 

Definition 4.4. Let M = (S, v, V) be a neighbourhood model. A subset X C 5 is called 
modally compact if for all sets of modal /^-formulas, Vl/ is satisfiable in X whenever ^ is 
finitely satisfiable in X. The neighbourhood model M is modally saturated, if for all s G S 



1 This perspective on modal saturation was pointed out to us by H.P. Gumm (personal correspondence). 
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and all modally coherent neighbourhoods X G v(s), both X and the complement X c are 
modally compact. 

To see why modal compactness is really a compactness property, note that for a subset 
X in a neighbourhood model Ai, X C fA/^] iff {—iip \ ift G \&} is not satisfiable in X. 
Hence X is modally compact, if and only if, for all \& C £ such that X C [V ^] there is 
a <=oj ^ such th at X C [\/ ^o]^. Clearly, any finite set is modally compact. Note also 



that, in Definition |44| due to the fact that {/\^} M Q X if and only if X c C [V^l^, 
we have that X c is modally compact, if and only if, for all \& C C such that [/\ ^ / ]' A/! C X, 
there is a # * such that [A^o]^ C X. 

Lemma 4.5. Let = (S", V) be a modally saturated neighbourhood model. For all 
X C S: X is modally coherent iff X is definable by a modal C-formula. 

Proof. If X = \<~p\' M for some ip £ then clearly X is modally coherent. For the converse 
implication, assume X is modally coherent, i.e., X is a union of modal equivalence classes 
X = \J ceC [x c ] = . For c £ C and y ^ x c there is a modal £-formula 6 c , y such that x c |= 5 c , y 
and y |= -i<5 Ci2/ , so by taking A c = {5 c , y \ y ^ x c ), we have [x c ]= = l/\A c j M C X 
for each c G C. By modal compactness of X c , for each c G C there is a finite subset 
A° C u A c such that [x c ]= C [AA^ C X. Defining <5 C = A A° for each c G C, we 
therefore have X = U c ecI^ c l' A/ ' - Now by modal compactness of X, we get a finite subset 
Ao Qw {$c | c G C} such that X = [VAo]^. That is, X is definable by the formula 
5 = VA . ' □ 

Proposition 4.6. If Ai is a modally saturated neighbourhood model, then modal equivalence 
is a congruence on Ai. It follows that modally equivalent states in Ai are behaviourally 
equivalent. 



Proof. Immediate consequence of Lemmas 4.3 and|4.5| D 



Corollary 4.7. The class of finite neighbourhood models is a Hennessy-Milner class. 
Proof. Since the disjoint union of two finite neighbourhood models is again finite, it suffices 



by Lemma |4.2| and Proposition 4.6 to show that finite neighbourhood models are modally 
saturated. But this is immediate, since any set of states in a finite neighbourhood model 
Ai, is necessarily finite, and hence modally compact, so Ai is modally saturated. □ 

The question remains whether the class of all modally saturated neighbourhood models 
is a Hennessy-Milner class. We conjecture that if Ai and Af are modally saturated then 
modal equivalence is a congruence on Ai +Af. If this is the case, then the Hennessy-Milner 
theorem follows from Lemma 14.21 



Remark 4.8. In |36j the following definition of modal saturation for monotonic neighbour- 
hood models was introduced, and it was shown that over the class of modally saturated 
monotonic neighbourhood models modal equivalence implies monotonic bisimilarity. A 
monotonic neighbourhood model (S, v, V) is monotonic modally saturated, if for all s G S 
and all sets of modal /^-formulas the following hold: 

(ml-mon) For all X G v(s), if \£ is finitely satisfiable in X, then is 
satisfiable in X. 

(m2-mon) If for all there is an X G v{s) such that IC(/\ ty ), 

then there is an X G v{s) such that X C (/\$>). 
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In a monotonic neighbourhood model Ai, (ml-mon) clearly implies that all modally 
coherent neighbourhoods are modally compact. The converse also holds, since for any 
neighbourhood X of some state s, the closure X' of X with respect to modal equivalence, 
i.e., X' = \J x&x [x]=, is also a neighbourhood of s by monotonicity, and for any ^ C 

'i' is satisfiable in X if and only if ^ is satisfiable in X' . However, it is not clear 
whether monotonic modal saturation and (neighbourhood) modal saturation coincide in 
all monotonic models. We suspect that neither implies the other due to the following. 
The condition (m2-mon) says that all neighbourhood collections are closed under arbitrary 
intersections of definable neighbourhoods, a property which we expect can be shown to 
fail in some modally saturated neighbourhood model. On the other hand, it is not clear 
why the complements of modally coherent neighbourhoods should be modally compact in 
a monotonic modally saturated model. Unfortunately, at the moment we have no examples 
that confirm these intuitions. 

Remark 4.9. A Kripke model K, = {S,R,V} is Kripke modally saturated, if for all s G S 
and all sets ^ of modal ^-formulas: 

(ml-krip) If is finitely satisfiable in R[s] , then \E' is satisfiable in R[s] , 

and over the class of modally saturated Kripke models, modal equivalence implies Kripke 
bisimilarity (see e.g. |T0j). From the above definitions, it is clear that for any augmented 
neighbourhood model Ai, if Ai is monotonic modally saturated or (neighbourhood) modally 
saturated, then At krp is Kripke modally saturated. However, if Ai krp is Kripke modally 
saturated, then modally coherent neighbourhoods may fail to be modally compact in Ai. 
This is shown by Example 4.18 (page |24[) in the next subsection. Hence Kripke modal satu- 



ration does not imply monotonic modal saturation nor (neighbourhood) modal saturation. 
Note that (m2-mon) holds over any augmented neighbourhood model. 



As we have seen in Remarks 4.8 and 4.9 the notions of neighbourhood, monotonic and 
Kripke modal saturation do not restrict in a natural way. Moreover, in the next subsection 
(Example 4.18), we will see that image-finite neighbourhood models are not necessarily 



modally saturated. These observations could be interpreted as arguments for saying that 
our definition of modal saturation for neighbourhood models is not the right one. On the 



other hand, Definition 4.4 arises in a natural manner, it implies Kripke modal saturation 
over Kripke models, in subsection 4.3 we show that ultrafilter extensions of neighbour- 



hood models are modally saturated, and in subsection 5.2 we will see that when viewing 
neighbourhood models as first-order models, then w-saturation implies modal saturation 



(Lemma 5.6 ). We believe these are good arguments for Definition 4.4 being the right notion 
after all. However, further investigations are needed to support this claim. It would be 
useful to have a better understanding of what an abstract notion of modal saturation for 
F-coalgebras should be. 



4.2. Image-finite neighbourhood models. In normal modal logic, we know that image- 
finite Kripke models are modally saturated, and hence form a Hennessy-Milner class with 
respect to Kripke bisimilarity. In this section, we describe image-finite neighbourhood 
models and prove that they form a Hennessy-Milner class, despite the fact that, in general, 
they are not modally saturated. 

Remark 4.10. We obtain our notion of an image-finite neighbourhood model by instanti- 
ating a widely used categorical definition. Similarly, we could obtain the Hennessy-Milner 
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result of this section by using a far more general theorem from coalgebraic modal logic. Our 
motivation for giving an "elementary" proof is that we want to equip the working modal 
logician with some intuition concerning image-finite neighbourhood models. We outline how 



the result could be obtained as a corollary from coalgebraic work in Remark 4.16 below. 



In contrast with the Kripke case, image- finite neighbourhood models are not necessarily 
modally saturated. Instead, we will show that they satisfy the condition of the following 
lemma. 

Lemma 4.11. Let Ai = (S, u, V) be a neighbourhood model. If for any states s±, S2 £ S and 
any modally coherent subset ICS there is a formula if £ C such that for any i E {1,2}, 
X G if and only if [<£>] E v{s2), then modal equivalence is a congruence on A4. 



Proof. Immediate by the characterisation given by conditions (cl) and (c2) on page|18[ □ 

A Kripke model is image-finite if every state has only finitely many successors (cf. [10J ) . 
For neighbourhood models, the notion of image-finiteness is less obvious, but as with bisimi- 
larity, universal coalgebra provides us with an abstract notion of image-finiteness for coalge- 
bras which we instantiate for the 2 2 -functor. The general construction behind this definition 
is that of taking the finitary part of a functor. Recall that we denote the inclusion map of 
Y C X by iy : Y <— > X. Given any functor F: Set — > Set, define the functor by letting 

F U (X) = \J{F(l y )[FY] \l y :Y^X,YC^X} 

for a set X, and for a function f:X—>Y, F w (/) is the restriction of F(/) to F W (X). It 
is known that F u is the unique finitary (or ^-accessible) subfunctor of F which agrees with 
F on all finite sets (see e.g. [SJ E2]), and F^ is called the finitary part of F. We now give 
a characterisation of the finitary part of 2 2 . For a subset inclusion map lb '■ B <^-* X and 
DCX, note that l£[D\ = D n B. If U £ 2i(X) and B C X is such that for all D C X: 
D eU <^=> D n B £ U, then we call B a base set for U. 

Lemma 4.12. Let X be a set. We have: 

2 2 U (X) = {U £ 2 2 {X) | 3B C w X.VD C X : (D e U <=^ DnB € U)}. 

Proof. The proof is obtained by spelling out the definitions. □ 

Definition 4.13. We define the class of image-finite neighbourhood frames as the class 
Coalg^ 2 ^) of 2 2 ^-coalgebras. The class of image-finite neighbourhood models is the class of 
neighbourhood models based on an image-finite neighbourhood frame. 

So, image- finite neighbourhood frames are the neighbourhood frames in which all neigh- 
bourhood collections are determined by a finite base set. It should be clear that a finite 
neighbourhood frame {S, v) is image-finite, since for all s £ S, S is a finite base set for v (s). 
In proving that image-finite neighbourhood models form a Hennessy-Milner class, we use 
the following lemma. 

Lemma 4.14. Let S be a set and 9 an equivalence relation on S. Moreover, let B C S and 
denote by Bg C B a set of representatives of the 6-classes intersecting B. For all X, X' C S, 
if X and X' are both 6 -coherent, then X n B = X' n B iff X n B e = X' n B e . 

Proof. Let S, B and Bq C B be as stated, and assume that X and X' are ^-coherent subsets 
of S. It is clear that X n B = X' f] B implies X n Bg = X' n Bg. For the other implication, 
assume X f] Bg = X' n Bg. We have: s £ X f] B implies there is an s' £ Bg such that s6s' . 
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Since X is ^-coherent, s' Glflfij = X' Pi Bg. Now since X' is ^-coherent, s £ X', and 
thus s £ X' n B. Hence we have shown X f] B C X' C\ B. The other inclusion is shown 
similarly. O 

Proposition 4.15. T/ie c/ass o/ image-finite neighbourhood models is a Hennessy-Milner 
class. 

Proof. The class of image- finite neighbourhood models is closed under disjoint unions, since 



for any functor F, the category Coalg(F) has coproducts (cf. [39] ) - By Lemma 4.2 it suffices 
to show that in an image-finite neighbourhood model, modal equivalence is a congruence. 
So let M. = (S, v, V) be image-finite, and let s,t £ S. We then have finite base sets 



B s ,Bt C w S for v(s) and v(t), respectively. Let B s t = B s U Bt- By Lemma 4.11 it suffices 
to find for any modally coherent X C S, a formula <p> £ C such that 

inB st = y} M nB st , (4.2) 

since then JnB s = {pj M nB s and InB ( = [ip] M nBt, and hence X 6 u(s) iff 6 i>(s), 

similarly for t, and consequently, if s = t, then X £ u{s) if and only if X £ z'(t)- 

We now show how to obtain such a </2. Let X C be modally coherent and let B^ C B^ be 
a set of representatives of the =-classes intersecting B s t. Since B s t is finite, so is B' st . Assume 
B' st = {s\, . . . , s n }. Now there are modal formulas (pi, . . . , ip n £ C which characterise 
si, . . . , s n , respectively, within B' st , that is, A4, Sj |= (pj iff i = j, for 1 < i,j < n. Namely, 
for each Sj £ B' st , we have for all Sj £ -B^ \ {sj}, Sj ^ Sj. Hence there is a formula such 
that M, Si \= ipij and M.,sj yjfj. Take ipi = /\ " =1 i = 1, . . . , n. We now define 



(p = \/{(pi \ Si £ X n B' st \. To see that ip satisfies (4.2) it suffices by Lemma 4.14 to show 
that XHB' st = l<p} M nB' st . Clearly, by definition of <p, if Si £XnB' st then s, £ yj M nB' st . 
Conversely, if Sj £ \<p\ fl .B^ then A^, Sj |= ipi for some i such that Sj £ X n i?s f . Since 
characterises Sj in B^, it follows that Sj = Si £ X n B^. □ 



Remark 4.16. As we already mentioned, Proposition 4.15| is a consequence of a more 



general result in coalgebraic modal logic, which we briefly explain here. In coalgebraic 
modal logic, the semantics of modalities is given by predicate liftings. A predicate lifting for 
a functor F: Set — ► Set is a natural transformation A: 2 — > 2 o F. Given a set A of predicate 
liftings for F, the finitary coalgebraic modal language C(A) is the multi-modal language 
which contains a modality [A] for each A £ A. Given an F-coalgebra X = (X, £), the truth 
of formulas is defined in the standard inductive manner for the basic Boolean connectives. 
The truth of a modal formula [\](f> is defined by: X,x \= [\]4> iff £ Ax ([</>]]'*')• Atomic 
propositions can also be interpreted using constant predicate liftings. We refer to |35j for 
details. 

Using currying, every predicate lifting A : 2 — > 2 o F corresponds to a natural transfor- 
mation A: F — > 2 2 , called the transposite of A. A set A of predicate liftings for F is called 
separating if the source of transposites {A | A £ A} is jointly injective. Schroder shows 
in |40[ Theorem 41, Corollary 45]) that if F: Set — > Set is a finitary functor, and A is a 
separating set of predicate liftings, then the finitary coalgebraic modal language £(A) is 
expressive for F-coalgebras, meaning that over the class of F-coalgebras, £(A)-equivalence 
implies behavioural equivalence. 

We can instantiate the result for the finitary functor 2^ x "P(At) and classical modal 
logic. The basic modal language and its interpretation over neighbourhood models is the 
finitary coalgebraic modal logic given by A = {A} U {pi \ i < u>}, where A: 2 — > 2 o 2^ is 
defined by \x{A) = {U £ 2 2 UJ (X) \ A £ U}, and the pi, i < u, are constant predicate liftings 
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that interpret the atomic propositions. It is known that {A} U {pi \ i < ui} is separating iff 
{A} is separating. The transposite A: 2^ — > 2 2 is simply the inclusion map, i.e., Ax = ^(x) 

for all sets X, so trivially {A} is jointly injective, hence {A} is separating. It now follows 
from Schroder's result that over the class of image-finite neighbourhood models, modal 
equivalence implies behavioural equivalence. 

We now show that the notion of image-finiteness for neighbourhood frames restricts to 
the subclasses of neighbourhood frames that correspond with Kripke frames and monotonic 
neighbourhood frames, respectively. 

Monotonic neighbourhood frames are coalgebras for the subfunctor Mon of 2 (cf. Re- 



mark 2.7 ) which sends a set X to the collection of all subsets of V(X) which are closed under 
supersets. Due to motonicity, given a function /: X — > Y, we can describe Mon(/) in terms 
of the direct image of /, namely, for all V E Mon(X), Mon(/)(V) = \J{U[D] | D E V}. 
Recall that for a subset B C X, ]B = {B' C X \ B C B'}. Image-finite monotonic 
neighbourhood frames, are then nothing but Mon^-coalgebras. By simply working out the 
definitions, we find that for a set X and U E Mon(X): 

[/ G Mon^(X) iff 3Ci,...,C n C w X:ff = TCiU...UTC n . 

The neighbourhood collections in an image-finite monotonic neighbourhood model are thus 
generated by finite sets of finite neighbourhoods which are minimal with respect to C in 
V{X). Such minimal neighbourhoods will be referred to as core neighbourhoods. More 
precisely, if M. = (S, v, V) is a neighbourhood model, s E S and C E v(s) is such that 
for all D C C, D ^ v(s), C is called a core neighbourhood of s. The collection of core 
neighbourhoods of s is denoted v c {s). This terminology follows |37 | 120] where image- finite 
monotonic neighbourhood models were called locally core finite. 

Finally, recall that a Kripke model (S, R, V) is image-finite, if for all s E S, the set of 
-R-successors R[s] is finite. 

Proposition 4.17. Let A4 = {S, v, V) be a neighbourhood model. 

(1) If M is a monotonic neighbourhood model, then M is image-finite as a monotonic 
neighbourhood model iff Ai is image-finite as a neighbourhood model. 

(2) If M is augmented, then Ai krp is image-finite as a Kripke model iff M is image-finite 
as a neighbourhood model. 

Proof. To prove item 1, let A4 be monotonic. Since Mon is a subfunctor of 2 2 , also Mon^ 
is a subfunctor of 2 W . It follows that any image- finite monotonic model is also image-finite 
as a neighbourhood model. Concretely, one can show that for all s E S, the union of core 
neighbourhoods B = [Jv c (s) is a finite base set for v{s). For the other direction, assume 
M is image-finite as a neighbourhood model. Let s E S, and assume B S is a finite 
base set for v(s). We first show that every neighbourhood is in the upwards closure of some 
finite core neighbourhood: U E z^(s) implies B PiU E ^(s), and since B n U is finite, there 
must be a finite C E u c (s) such that C C B PiU C U. Suppose now that C E u c (s) is an 
arbitrary core neighbourhood of s. As B is a base set for v(s), C n B E v{s), and hence by 
C-minimality of C, C C B. It now follows from the finiteness of B, that s has only finitely 
many core neighbourhoods C±, . . . ,C n of finite cardinality, and v(s) = j C\ U . . . U f C n . 

For item 2, let M kvp = (S,R,V), i.e., for all s E S, u(s) = | i?[s], and i^ c (s) = 
This immediately shows that if Ai krp is image-finite then M is image-finite as a monotonic 
model, and hence by item 1, also as a neighbourhood model. Conversely, if M is image-finite, 
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then by item 1 M is image-finite as a monotonic model, hence for all s G S, [J v c {s) = R[s] 
is finite. D 

The following example demonstrates that image-finite neighbourhood models are not 
necessarily modally saturated, and it also shows that a Kripke modally saturated model, is 
not necessarily modally saturated as a (monotonic) neighbourhood model. 

Example 4.18. Consider the Kripke model K, = {S, R, V) where S = N, the set of natural 
numbers, and R is the usual relation > on N, that is, for m, n G N, (m, n) G R iff m > n, 
and R[m] = {n G N | n < m}. Finally, the valuation V is defined as V{pi) = 0, for all 



atomic propositions pi G At. K, is an image-finite Kripke model, hence by Proposition 4.17 
the augmented neighbourhood model /C aug corresponding to K, is also image-finite as a 
(monotonic) neighbourhood model. Since fC is image-finite, K, is Kripke modally saturated. 
However, /C aug is not modally saturated as a neighbourhood model nor as a monotonic 
model. To see this, first note that the set N is trivially modally coherent and by monotonicity 
N is also a neighbourhood of every n G N. Now, consider the set of modal /^-formulas, 
* = {O n D_L | n G N}. Note that by transitivity, K,m \= O n D_L iff m > n. Since K, 
and /C aug are pointwise equivalent, and every finite subset \&o * is satisfiable in K, at 
the maximal n G N such that O n nJ- G \l/oj it follows that ^ is finitely satisfiable in the 
neighbourhood N in /C aug . However, \& is clearly not satisfiable in N. We have thus shown 
that N is not modally compact, hence /C aug is not (monotonic) modally saturated. 



4.3. Ultrafilter extensions. In this section, we prove a behavioural-equivalence-some- 
where-else result by showing that any two modally equivalent states of neighbourhood 
models have behaviourally equivalent representatives in the ultrafilter extensions of these 
neighbourhood models. To this end, we define ultrafiler extensions of neighbourhood mod- 
els, and we prove analogues of results known for ultrafilter extensions of Kripke models. In 
particular, we show that ultrafilter extensions are modally saturated. This result will be 



used in our proof of Craig interpolation in subsection 5.3 

Just as ultrafilter extensions of Kripke models are obtained from algebraic duality (see 
e.g. [TO])) ultrafilter extensions of neighbourhood models are a by-product of a more general 
duality between coalgebras and certain algebras on the category of Boolean algebras, as 
described in e.g. |24| 127] . Our definition of ultrafilter extensions of neighbourhood frames is 
obtained by instantiating the more general definition of ultrafilter extensions of F-coalgebras 
presented in [27 to F = 2 2 . The basic properties follow from the category theoretical 
framework. With quite some effort, the behavioural-equivalence-somewhere-else result can 
be obtained as a special case of a more general theorem in [23] . However, instead of requiring 
knowledge of the (rather abstract) theory in |24[ 127] , we have chosen to give a direct, concrete 
description of ultrafilter extensions of neighbourhood models, and to use standard model- 
theoretic techniques to prove basic properties. We believe that such a presentation will 
make the results of this section and the proof of the Craig interpolation theorem better 
accessible to readers whose background is mainly in modal logic. For the interested reader, 



we give a brief summary of the construction from [27] in Remark 4.21 

Let us begin by introducing some terminology and notation, and recalling some facts 
concerning ultrafilters. 

Definition 4.19. Let S be a non-empty set. A set u C V(S) is called an ultrafilter over S 
if S G u, U\, U2 G u implies U\ D U2 G u, U\ G u and XJ\ C !7 2 C S implies U2 G u, and for 
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all C/ C S we have: U G u iff S \ L 7 " G" u. The collection of ultrafilters over S will be denoted 
by Uf(5). For a set S and a subset U C S, we define 

J7 := {u G Uf(5) | Z7 € u}. 
For a set 5 and s G S, we define 

u s := {U C 5 | s G [/}. 

It can easily be confirmed that u s G Uf(5). The induced map u: 5 — > Uf(5) is called the 
principal ultrafilter map and u s is the principal ultrafilter generated by s. 

The duality betwen Stone spaces and Boolean algebras gives rise to the following two 
contravariant functors. IP: Set op — * BA maps a set X to its Boolean algebra of subsets. The 
functor U: BA —* Set op maps a Boolean algebra to the set of its ultrafilters. Both functors 
can be regarded as subfunctors of the contravariant powerset functor 2, as they both map 
a morphism / in their respective categories to the inverse image function / . Composing 
these functors, we find that for a set X, UP(X) = Uf(X), and for a function f:X—>Y, 
UP(/) = (f 1 ) 1 - Hence Uf can be regarded as a subfunctor of 2 2 . 

The following definition of ultrafilter extensions of neighbourhood models is obtained 



by instantiating the corresponding coalgebraic notion for F-coalgebra s in 
that F = 2 2 . We sketch the main ideas of the construction in Remark 4.21 



[2"7] to the case 
below. In fact, 



the definition of the neighbourhood relation of the ultrafilter extension goes back to the 
definition of the canonical neighbourhood model in 



Definition 4.20. Let M = {S, v, V) be a neighbourhood model. The ultrafilter extension 
of M is defined as the triple M u := (Uf(S),/z, V u ), where 

• Uf (5) is the set of ultrafilters over the set S, 

• [i : Uf(5) -> 2 2 (Uf(5)) is defined by 

/i(u) := {U C Uf(5) | U C S, MU G u}, 

where for any U C S we put MU := {s G S \ U G ^(s)}, 

• V u (p) := {u G Uf(5) | V(p) G u}. 

Remark 4.21. In |27j the neighbourhood functor 2 2 is denoted by TL. Given the coalgebraic 
modal logic for neighbourhood frames with one predicate lifting for the interpretation of 



the D-operator (see Remark 4.16) one can define a functor L: BA — > BA such that the 
category of L-algebras provides the algebraic semantics of the logic. For a Boolean algebra 
A = (A, +, — ,0), L(^4) is the free Boolean algebra generated by {Da \ a G A}. Let Alg(L) 
be the category of L-algebras over B A. The functors P : Set op — > BA and U : BA — > Set op are 
extended to functors P : Coalg(2 2 ) op -> Alg(L) and U: Alg(L) Coalg(2 2 ) op . The ultrafilter 
extension of a 2 2 -coalgebra (S, v) is then obtained as tJP((S,u)). The lifting of P and U 
relies on the existence of two natural transformations: 5: LP — > P2 2 and h: UL — > 2 D 
whose components at a set X are defined as follows (cf. Def. 2.6.5 and Ex. 3.6 of |27] ) : 

8 x (pV) = {N G 2 2 (X) | [/ G A^} 

/i x (u) = {U C UP(X) | □£/" G J7} 

The liftings P and U are now given as follows on objects: P maps a 2 2 -coalgebra (X, v) to 
P((X, z/) ) = (LP(X),P(i/) o <5 X ) as illustrated here: 

LP(X) P2 2 (X) -^t P(X) 
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U maps a {A, a) in Alg(L) to V((A, a)) = (V(A), h A o U(a)>: 

U(A) UL(„4) -K- 2 2 (U(„4)) 
By working out the details, the reader can now confirm that the composition UP yields the 



ultrafilter extension of neighbourhood frames provided in Definition 4.20 



The construction of the ultrafilter extension in Definition 14.201 can be seen as an ex- 
tension of the Set-functor Uf: Set — ► Set to a functor Nbhd — > Nbhd such that for 
any neighbourhood model A4, the principal ultrafilter map u is truth-preserving injective 
map from M into M u . In order to see that the construction (_)" of the ultrafilter exten- 
sion is functorial we show that bounded morphisms between neighbourhood models induce 
bounded morphisms between the corresponding ultrafilter extensions. 

Lemma 4.22. Let M.\ = (S\,v\,V\) and M2 = {S2, ^2^2) be neighbourhood models an 
let f : Si — > S2 be a bounded morphism from Aii to M.2- The function f u := Uf(/) is a 
bounded morphism from M\ = (Uf (Si), Hi, Vj 1 ) to M'^ = (Uf(52), ^2, V^)- 

Proof. It can easily be confirmed that for any subset U C S2: [f u )~ l \U] = f _1 \U] and 
/ _1 [Klt/] = M(f~ l [U}). To prove that f u is a bounded morphism, let u G Uf(Si) and 
U C S2- We now have: 

£/ G /x 2 (/"(")) iff SC/G/«(u)=2 2 (/)(u) 

iff f-^MU] = M(f- 1 [U}) Gu 

iff f^U] = (n- 1 [U]e^(u). 

Moreover, /" respects valuations: Vi(p) G u iff f^ 1 [V2(p)] G u iff ^(p) G / n (u). □ 

The next proposition connects truth of a modal formula in the ultrafilter extension to 
the truth set of the formula in the original model. 

Proposition 4.23. Let A4 = {S,v,V) be a neighbourhood model with ultrafilter extension 
M. u . For all u G Uf(5) and for all formulas ip G £ we have 

M u ,u^ip iff {<p\ M G u. 

Proof The standard proof is obtained by induction on the formula (p. Details are left to 
the reader. □ 



Using Proposition 4.23 we now easily show that the principal ultrafilter map u preserves 
the truth of modal formulas. However, it is important to note that, in general, u is not a 
bounded morphism from a model M = (S, V) to its ultrafilter extension A4 U . 

Lemma 4.24. Let Ai = (S, v, V) be a neighbourhood model with ultrafilter extension M u = 
(Uf(S'), fi, V u ) and let u : S — > Uf(S') be the injective map from S to Uf(5). For every modal 
formula <p we have M, s \= ip iff M u , u s \= ip. 

Proof. Let sgS and let ip be modal formula. Then M., s \= (p iff s G \<p\ M iff \<p\ M G u s 



iff M u , u s \= tp where the last equivalence is a consequence of Prop. 4.23 D 
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Another consequence of Proposition 4.23 is the fact that ultrafilter extensions are 
modally saturated. 

Proposition 4.25. For any neighbourhood model M, the ultrafilter extension M u is modally 
saturated. 

Proof. Let M = (S,u,V) and M u = <Uf(5), fi, V u ). We show that any U C Uf(5) is 
compact. This suffices since all neighbourhoods in M u are of the form U C Uf (5) and for 
any U, XJf(S) \ U = U c . Let $ be a set of formulas with the property that $ is finitely 
satisfiable in U. For any finite set of formulas {^i, . . . , VVi} C v|/ there e xists therefore an 
ultrafilter u £ i7 such that .M M , u |= A . . . A ip n . This implies by Prop. 

m] M ,...M M }u{u}cu 

Since u is closed under finite intersections this implies ' 5 1 ' 
hence [V>il^ n 
that the set X 



4.23 



that 



;y- • n . . . n lip n j M fl [/ £ u and 
n [V'nF^' H C/ ^ 0. As the set {tpi, . . • , ip n } was arbitrary we conclude 
{U} U {[[?/>] ^ | ip £ ^} nas the finite intersection property. Hence by 
the ultrafilter theorem, there exists some ultr afilter u' £ Uf(S') such that X C u'. By 
construction we get u' £ U and again by Prop. 



1\M 



4.23 



that is satisfiable at u' £ f7. 



□ 



We are now able to prove that the class of ultrafilter extensions of neighbourhood 
models is a Hennessy-Milner class. 

Proposition 4.26. The class U := {M u \ M £ Nbhd} of ultrafilter extensions of neigh- 
bourhood models is a Hennessy-Milner class. 

Proof. Let Mi and M2 be arbitrary neighbourhood models. By Lemma 4.2 it suffices to 



show that modal equivalence is a congruence on the disjoint union Mf + M\ of their ultra- 
filter extensions. By Proposition 4.25, (Mi+M2) u is modally saturated, hence the quotient 
map e: (.Mi + M.2) w — > (Mi + M.2) u / = is a bounded morphism. Furthermore, denote 
-> Mi + A^2) i £ {1)2}, the canonical inclusion morphisms. By Lemma 4.22 
{Mi+M 2 ) u 



by Li : Mi 
lY: Mf - 



i £ {1,2}, are bounded morphisms, hence there exists, by the 
universal property of the disjoint union Mf + M\ , a bounded morphism g such that the 
following diagram commutes: 

Mi - - > Mi c ^ 7W« + ^ 3 x« ^ _ _ 



(Mi+M 2 ) u 



(Mi + M 2 ) u /= 

Hence e o g: Mf + TWf — > (Mi + M^f 1 1= is a bounded morphism, and two ultrafilters in 
Mf + M^ are modally equivalent if and only if they are identified by eo g. It follows that on 
Mi + M-2, the modal equivalence relation is the kernel of e o g, and hence a congruence. □ 

As a corollary we obtain the behavioural-equivalence-somewhere-else result. 

Theorem 4.27. Let Mi = (Si, fi,Vi) and M2 = (S2, 1^2, V2) fre neighbourhood models with 
the respective ultrafilter extensions Mf and M%- For all states si £ Si and S2 £ S2 we 
have 

Mi,si=M 2 ,s 2 => Mi,u Sl M2,u S2 . 
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Proof. Let s% and S2 be modally equivalent states in M.\ and M.2, respectively. By 



Lemma 4.24 the states u Sl and u S2 of the ultrafilter extensions and are modally 



equivalent as well. The claim is now a direct consequence of Prop 4.26 D 



5. Model-theoretic results 

5.1. The classical modal fragment of first-order logic. We will now prove that the 
three equivalence notions described in section [3] all characterise the modal fragment of first- 
order logic over the class of neighbourhood models (Theorem |5.5[ ). This result is an analogue 
of Van Benthem's characterisation theorem for normal modal logic (cf. [8]): On the class 
of Kripke models, modal logic is the Kripke bisimulation-invariant fragment of first- order 
logic. It is well known that, when interpreted over Kripke models, the basic modal language 
£ can be seen as a fragment of a first-order language which has a binary predicate Rrj, and 
a unary predicate P for each atomic proposition p in the modal language. Formulas of this 
first-order language can be interpreted in Kripke models in the obvious way. Van Benthem's 
theorem tells us that a first-order formula a(x) is invariant under Kripke bisimulation if 
and only if a(x) is equivalent to a modal formula. 

The first step towards a Van Benthem-style characterisation theorem for classical modal 
logic is to show how C can be viewed as a fragment of first-order logic. We will translate 
modal formulas into a two-sorted first-order language C\, which has previously been em- 
ployed in proving a Van Benthem style characterisation theorems for topological modal 
logic [11 and monotonic modal logic [36 , and for reasoning about topological models more 



generally [15 . In Remark 5.8) we will give a more detailed comparison between our charac- 
terisation theorem and the characterisation theorem for monotonic modal logic given in [36 . 
The two sorts of the language C\ are denoted s and n. Terms of sort s are intended to repre- 
sent states, whereas terms of sort n are intended to represent neighbourhoods. We assume 
there are countable sets of variables of each sort. To simplify notation, we will not state the 
type of variables explicitly. Instead we use the following conventions: x, y, x' , y', xi,y2, ■ ■ ■ 
denote variables of sort s (state variables) and u, v, u' , v' ,u\,vi, . . . denote variables of sort 
n (neighbourhood variables). Furthermore, the language L\ contains a unary predicate Pj 
(of sort s) for each i G u>, a binary relation symbol N relating elements of sort s to elements 
of sort n, and a binary relation symbol E relating elements of sort n to elements of sort s. 
The intended interpretation of xNu is "u is a neighbourhood of x", and the intended inter- 
pretation of uEx is u x is an element of it" . The language C\ is generated by the following 
grammar: 

tp, ip ::= x = y\ u = v\ PjX | xNu \ uEx \ —up \ cp A ip \ 3xp \ Butp 

where i G u; x and y are state variables of sort s; and u and v are neighbourhood variables 
of sort n. The usual abbreviations (eg. V for — 13 — ■) apply. 

Formulas of C\ are interpreted in two-sorted first-order structures of the type 9Jt = 
(D s ,D",{Pi | i G u},N,E) where D s and D" are the carrier sets of sort s and sort n, 
respectively, and each Pi C D s , N C D s x D" and E C D" x D s . The usual definitions of 
free and bound variables apply. Truth of sentences (formulas with no free variables) (p G C\ 
in a structure 9Jt (denoted Wl \= ip) is defined as expected. If x is a free state variable in 
(p (denoted ^p(x)), then we write Wl \= ip[s] to mean that (p is true in Wl when s G D s is 
assigned to x. Note that 9JI |= 3xip iff there is an element s G D s such that £DT |= (p[s\. If 
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\P is a set of £i-formulas, and 9PT is an £i-model, then OJt |= \& means that for all ip E 
9Jt\= if). Given a class K of £i-models, we denote the semantic consequence relation over K 
by |=k- In particular, for ty(x) U {(p(x)} C C\, ^(x) |=k if for all 9JI E K and all s of 
sort s in 9Jt, SOT |= $[s] implies 9JT |= y[s]. Moreover, a set of formulas ^(x) is K-consistent 
(<&(x) ^=k J-) if there exists an 971 E K and an s of sort s in 971 such that Wl \= $>[s]. 

We can now translate modal /^-formulas and neighbourhood models to the first-order 
setting in a natural way: 

Definition 5.1. Let M = (S, u, V) be a neighbourhood model. The first-order translation 
of M is the structure M° = (D s ,D",{Pi \ i E u},R v ,R 3 ) where 
. D S = S, D" = v[S) = l) seS v(s) 

• Pi = V(pi) for each i E u, 

• R v = {(s,U) \s £D 5 ,U E i/(8)}, 

• i? 9 = {([/, s) | s g D s , s e C/}. 

Definition 5.2. The standard translation of the basic modal language is a family of func- 
tions st x : C — > £i defined as follows: s£ x (_L) = ""(a; = x), st x (pi) = PjX, st x {-^p) = ->st x (<p), 
st x (<p Aip) = st x (ip) A st x (ip), and 

sia,(p<£>) = 3«(xN-u A (\/y(uEy <-> st y (ip))). 

This translation preserves truth; the easy proof is left to the reader. 

Lemma 5.3. Let M be a neighbourhood model and tp E C For each s E S, A4,s \= 
<p iff M° \= st x {cp)[s}. 

In the Kripke case, every first-order model for the language with R\j can be seen as 
Kripke model. However, it is not the case that every £i-structure is the translation of a 
neighbourhood model. Luckily, we can axiomatize the subclass of neighbourhood models 
up to isomorphism. Let NAX be the following axioms 

(Al): \/u3x(xNu) 

(A2): Vu, v((Vx(uE.x <-> vEx)) — > u = v) 
It is not hard to see that if M is a neighbourhood model, then A4° \= NAX. The next 
result states that, in fact, NAX completely characterises the class N := {9Jt | 9JT = 
A4° for some neighbourhood model A4}, where = denotes isomorphism of £i-models. 

Proposition 5.4. Suppose 971 is an C\-model and 9JT |= NAX. Then there is a neighbour- 
hood model 9Jt such that 9JT ^ (9JT ) ■ 

Proof. Let 9tt = (D s ,D n ,{Pi \ i E u},N,E) be an A-model such that 9Jt |= NAX. We 
will construct from 9Jt a neighbourhood model 9JT = (S,v,V) such that Wl = (9Jt )°. In 
case D s = we also have D n = by axiom Al and hence we define 9JT to be the empty 
neighbourhood model. In the case D s ^ we first define a map r/ : D" — » V{D S ) by 
r](u) = {s E D s | uEs}. We take S = D s . Now define for each s E 5 and each ICS: 
X E i/(s) iff there is a n E D" such that sNu and X = Tj(u), and define for all i E w, 
V(pi) = {s E S 1 | 9Jt |= Pj[s]}- Then 9Jt is clearly a well-defined neighbourhood model, 
and it is not hard to see that the maps id : D s — > Z? s and rj : D" — > UseD s ^( s ) yield an 



isomorphism from 9Jt to (9Jl )° = (5,i/[5],{i^ | i E w},^,^) (cf. Definition 5.1). The 



details are left to the reader. □ 
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Thus, in a precise way, we can think of models in N as neighbourhood models. In 
particular, if 971 and 97 are in N we will write 97t + 91 by which we (strictly speaking) mean 
the £i-model (97T + 91 )° (which is also in N). Furthermore, Proposition 5.4 implies that we 
can work relative to N while still preserving nice first-order properties such as compactness 
and the existence of countably saturated models. These properties are essential in the proof 
of Theorem 15.51 



5.2. Characterisation theorem. We are now able to formulate our characterisation the- 
orem. Let ~ be a relation on model-state pairs. Over the class N, an £i-formula a(x) 
is invariant under ~, if for all models 97?i and 9712 in N and all sort s-domain elements 
s\ and S2 of 971i and 9712, respectively, we have 9Jti,si ~ 9712, S2 implies 971i \= a[si] iff 
9712 \= a[s2\- Over the class N, an £i-formula a(x) is equivalent to the translation of a 
modal formula if there is a modal formula ip £ C such that for all models 971 in N, and all 
s-domain elements s in 971, 971 |= a [s] iff 3JT |= st x ((p)[s]. 

Theorem 5.5. Let a{x) be an L\-formula. Over the class N the following are equivalent: 

(1) a{x) is equivalent to the translation of a modal formula, 

(2) a{x) is invariant under behavioural equivalence, 

(3) a{x) is invariant under precocongruences, 

(4) a(x) is invariant under 2 -bisimilarity. 

Our proof of Theorem |5.5| uses essentially the same ingredients as the proof of Van 
Benthem's theorem (see e.g. [TO]) where the main steps are: 

(1) Given a Kripke model Ai we can obtain a modally saturated, elementary extension Ai* 
ofM. 

(2) Between modally saturated Kripke models, modal equivalence is a Kripke bisimulation. 
Together, 1 and 2 imply that modally equivalent states Ai, s and Af,t are Kripke bisimilar 
in their modally saturated, elementary extensions Ai*,s* and M*,t*. Our analogue of 2 is 
that in a modally saturated neighbourhood model, modal equivalence is a congruence, which 
we have shown in Proposition |4.6| If we can show an analogue of 1 , it follows that if Ai , s 
and M, t are modally equivalent, then they have behaviourally equivalent representatives in 
a modally saturated, elementary extension of Ai + N . 

As in the Kripke case, we can obtain an unsaturated, elementary extension of any C±- 
model in the form of an ultrapower using standard first-order logic techniques (see e.g. [12]). 
It then only remains to show that an w-saturated neighbourhood model (viewed as a L\- 
model) is modally saturated. Before we state and prove this lemma, we recall (cf. [12 ) 
the definition of w-saturation. Let 9JT be a first-order £i-model with domain M. For a 
subset C C M, the C -expansion Ci[C] of C\ is the two-sorted first-order language obtained 
from C\ by adding a constant c for each c S C. Now £i[C] -formulas are interpreted in 9Jt 
by requiring that a new constant c is interpreted as the element c. The £i-model 971 is 
lo- saturated, if for every finite C C w M, and every collection T(x) of £i[C] -formulas with 
one free variable x the following holds: If T(x) is finitely satisfiable in 9Jt (equivalently, if 
T(x) is consistent with the £i[C] theory of 971), then T(x) is satisfiable in 971. It is a classic 
result of model theory that every model has an unsaturated elementary extension (cf. |12] ) 

Lemma 5.6. Let 971 be a model in N, and let 97T be its corresponding neighbourhood model. 
If 97T is to-saturated, then 97t is modally saturated. 
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Proof. Let 97T be an £i-model in N, 97t = (5, u, V) its corresponding neighbourhood model 



(cf. Proposition 5.4), and assume that 971 is unsaturated. Let $ be a set of modal C- 
formulas, and let U C S be a neighbourhood of some state s. Then U corresponds to a 
domain element u £ D n of 971 via the isomorphism 971 = (97t )°. If \P is finitely satisfiable in 
U in 97T , then the set of £i[{u}]-formulas {uNx} U {st x (ip) \ ip £ ^} is finitely satisfiable in 
971, and hence satisfiable, which implies that is satisfiable in U. Similarly, if is finitely 
satisfiable in U c , then the set of £i[{-u}]-formulas {-iuNx} U {st x {ip) \ ip £ ^f} is finitely 
satisfiable in 971, and hence satisfiable, which implies that \& is satisfiable in U c . D 

We are now ready to prove Theorem |5.5| 



Proof of Theorem 5.5 It is clear that 2 => 3 4 (cf- Proposition 3.10). To see that 4 =^ 
2, we only need to recall (cf. [39 ) that graphs of bounded morphisms are 2 2 -bisimulations. 
Furthermore, as truth of modal formulas is preserved by behavioural equivalence, 1 => 2 is 
clear. We complete the proof by showing that 2 1. 

Let MOCn(o;) = {st x (ip) \ ip £ C, a(x) |=n st x (ip)} be the set of modal consequences 
of a(x) over the class N. It suffices to show that MOCn(«) \=n a(x), since then by 
compactness there is a finite subset T(x) C MOCn(«) such that T(x) |=n ol{x) and a{x) [=n 
f\T{x). It follows that over N, a{x) is equivalent to f\T(x), which is the translation of 
a modal formula. So suppose 97T is a model in N and MOC]\j(a) is satisfied at some 
element s in 971. We must show that 97T |= a[s]. Consider the set T(x) = {st x (ip) 
97T ,s \= 93} U {a(x)}. T(x) is N-consistent, since suppose to the contrary that T(x) is N- 
inconsistent, then by compactness, there is a finite collection of modal formulas ipi, . . . , (p n 
such that 97t , s \= ipi for all i = 1, . . . , n and a{x) \=n -1 AILi ^xi^i), which implies that 
AILi s ^x(fi) G MOCn(«). But this contradicts the assumption that 971 |= MOCN(a)[s] 
and 97T \= st x {ipi)[s\ for all i = 1, . . . ,n. Hence T(x) is satisfied at an element t in some 
G N, and by construction, s and t are modally equivalent: For all modal formulas 99 £ C, 
97T |= st x (ip)[s] implies st x ((p) £ T(x), and hence 91 |= st x (ip)[t]. Conversely, 971 ^= st x (ip)[s] 
iff 97T |= -ist x (ip)[s] which implies st x (-np) = ->st x ((p) £ T(x), and hence 91 ty= st x (<p)[t]. 

Take now an unsaturated, elementary extension il of 97t + 91. Note that il £ N, since 
validity of NAX is preserved under elementary extensions. Moreover, the images su and t\j 
in il of s and t, respectively, are also modally equivalent, since modal truth is transferred 
by elementary maps. Now since il is w-saturated and thus by Lemma |5.6| ilo is modally 



saturated, it follows from Proposition 4.6 that su and tjj are behaviourally equivalent. The 



construction is illustrated in the following diagram; < indicates that the map is elementary. 
MOC N (a)[s] H — ^ SCT + 9T ^— 9T |= a[t] 



U 

Finally, we can transfer the truth of a{x) from 9T, t to 971, s by using the invariance of modal 
formulas under bounded morphisms and standard translations (bm+st); elementary maps 
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(elem); and the assumption that a(x) is invariant under behavioural equivalence (a(x)-beh- 
inv). 

m \= a[t] <^=> (9JT + ^o)° h oc\j(t)] (bm+st) 
<4=> il |= a[tjj] (elem) 

•<=>• il |= afsf/] ( s u —b tu an d a(x)-beh-inv) 

(9Jto + fTto) |= a[i(s)] (elem) 
M \= a[s] (bm+st) 

□ 



Remark 5.7. Note that in the proof of Theorem 5.5 we could have assumed a{x) to be 



invariant for any of the three equivalence notions, since Proposition 3.20 tells us that also 



su 



t v and su t^ p tu- 



Remark 5.8. An analogue of Van Benthem's theorem for monotonic modal logic was proved 
by Pauly (see |36| [20]). Although the translation of monotonic modal logic and monotonic 
neighbourhood models is very similar to ours, Pauly's approach is slightly different to the 
present one, since his result is not formulated relative to the class of first-order models which 
are the translation monotonic models. Rather, he defines a notion of monotonic bisimulation 
which applies to all first-order £i-models, and shows that translations of monotonic modal 
formulas are invariant under this bisimulation notion, even if the first-order models involved 
are not necessarily translations of monotonic models. This means his result concerns a 
stronger notion of invariance. The converse is shown using w-saturation and monotonic 
modal saturation, and is similar to the proof of the Van Benthem theorem. We do not get 
a characterisation theorem for monotonic modal logic (relative to translations of monotonic 
models) as a direct corollary of Theorem 5.5 , but we believe it is possible to prove one using 
the same line of argumentation and constructions. 



Remark 5.9. It seems straightforward to generalise Theorem 5.5 to multi-modal classical 



modal logic with polyadic modalities of finite arity. Multi-modal neighbourhood models are 
of interest in coalgebraic modal logic due to the following: 

It is not always possible to find a collection of separating unary, predicate liftings for a 
functor F: Set — ► Set. However, Schroder showed in [40J that any finitary functor F has a 
separating set of finitary, polyadic predicate liftings, i.e., there exists a finitary coalgebraic 
modal logic with polyadic modalities which is expressive for F-coalgebras. A fc-ary predicate 
lifting A: (2^) — > 2 F (~) has transposite Ax : F(X) — ► N fc (X), where N fc denotes the functor 
N fc = 2H o (2(-)) fc . Note that a map X —* N k (X) is a fc-ary neighbourhood function. If 
A is a separating set of fc-ary predicate liftings for F, then for all sets X, the source of 
transposites {Xx '■ F(X) — > N k (X) | A € A} yields a natural embedding. 

(A) AeA : F^n A N fc , (5.1) 

where n A N fc is the | A | -fold product of N k . Hence for every finitary functor F, an F-coalgebra 
can transformed into a pointwise equivalent multi-modal, polyadic neighbourhood frame. 



5.3. Interpolation. In this section we show that the results on ultranlter extensions from 
the previous section can be used to prove Craig interpolation for classical modal logic. 
For several normal and monotonic modal logics, Craig interpolation can be proved using 
superamalgamation in the corresponding variety of modal algebras, see e.g. |16[ I2T] 128) 
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30] . We believe similar proofs can be carried out for classical modal logic. Our proof, 
however, is based on the ideas used in the proof of Craig interpolation for normal modal logic 
presented in [6]. The proof in [6j uses first-order model-theoretic arguments similar to those 



employed in the proof of the Van Benthem characterisation theorem, but Theorem 4.27 
allows us to prove Craig interpolation in a purely modal setting, without the use of un- 
saturated models or the explicit use of algebraic duality. All that is needed is that modal 



truth is invariant under ultrafilter extensions (Lemma 4.24), and that ultrafilter extensions 



are modally saturated (Proposition 4.25). 



So far we have worked with a fixed a set At of atomic propositions, giving rise to the 
language C = £(At). In the current section we need to generalise our notions of bounded 
morphism and modal saturation to sublanguages £(At') of £(At) generated by a specific 
subset At' of atomic propositions. We point out that all models are always models for the 
full language £(At). This generalisation is straightforward, but in the interest of clarity we 
provide the details and the exact results we need. Let At' C At, and let M% = (Si, vi,Vi) 
and M.2 = {S2, ^2, V2) be neighbourhood £(At)-models. A function /: S\ — > S2 is a bounded 
C(At') -morphism from Mi to M2 (notation: /: Mi -^c(At') -^2) if / is a bounded (frame) 
morphism from (Si,Ui) to (S2, ^2)1 an d for all p G At', and all s G S±: s G Vi(p) iff 
/(s) G V2{p)- An £(At')-congruence is the kernel of a bounded £(At')-morphism. Two 
states si G S\ and S2 G S2 are modally £(At')- equivalent (notation: s\ =£, At '\ S2), if they 
satisfy the same £(At')-formulas. Given a neighbourhood £(At)-model M = (S,u,V), a 
subset X C S is modally £(At')- compact if for all sets of modal C{ At') -formulas, ^ is 
satisfiable in X, whenever is finitely satisfiable in X, and M is modally £(At ) -saturated if 
for every =£( At « -coherent neighbourhood X, both X and X c are modally £(At')-compact. 

Lemma 5.10. Let At' C At. 

(1) If M.\ and M.2 are C(At) -neighbourhood models, and f : A4i ^c(At') M2, then for all 
s in Mi, and all <p G £(At'); M\,s \= <p iff M2, f{s) \= (p. 

(2) If M = (S,v,V) is a neighbourhood £(At) -model, and R C S x S is an equivalence 
relation, then R is an £(At') -congruence on M iff R is a congruence on the underlying 
frame (S, v) , and for all (s, t) G R, and all p G At': s G V(p) iff ' t G V(p). 

(3) If a neighbourhood C(At) -model M is modally £(At')- saturated, then all =c(At')~ coherent 
subsets are definable by an £(At') -formula. 

(4) // a neighbourhood C(At)-model M is modally £(At') -saturated, then =£( At /) is an 
£(At')- congruence. 

(5) If M is neighbourhood C(At)-model, then its ultrafilter extension M u is modally £(At')- 
saturated. 

Proof. As usual, 1 can be proved by straightforward formula induction. Item 2 is immediate. 



Item 3 can be proved by retracing the argument used in Lemma 4.5 Item 4 follows from 



item 3 and essentially the same argument used in Lemma 4.3 Item 5 can be proved in the 



same way as Proposition 4.25 D 

For a formula ip G £, we denote by At(ip) the set of atomic propositions occurring in 
<p. Recall that for $ U {(/?} C C, we write $ \= ip if (p is a local semantic consequence of $ 
over the class of all neighbourhood models. Note that compactness of |= follows from the 
compactness of |=n, the first-order consequence relation over the class of neighbourhood 
models. 
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Theorem 5.11 (Craig interpolation). Let <pi,(f2 G £• If \= <fii — * ^2, then there exists a 
formula x S C with At(x) C At(</?i) n At(<^2) suc/i t/iat |= 991 — > x a^<i |= X ~ * ¥>2- 

Proof. Assume that |= y>i — > <p2- Let Atj = At((fi), i = 1,2, and Ato = Ati n At2- Denote 
by Cons£(At )( ( / J i) = {x £ £(Ato) I ¥>i |= x} the set of modal £(Ato)-consequences of 
c^i . It suffices to show that Cons£( A t )(¥>i) |= ^2, since then by compactness, there are 
Xl, . . . , Xn G Cons £(Ato) (^i) such that Xl A . . . A Xn h <P2, and tpi \= xi A . . . A Xn, he, 
X = Xi A . . . A Xn is a Craig interpolant for ip\ — ► ^2- 

So, assume is an £(At)-model and s is a state in M. such that Ai, s \= Cons£( Ato )((/?i), 
and let <i7 = G £(Ato) | A4,s |= il)}. Now \& U {tfi} is consistent, since otherwise 
there would exist {ipi, . . . ,ip n } C \& such that |= tpx A . . . A ip n — > ->(pi, hence |= tpi — > 
-1^1 V ... V -i^nj which would imply that -1^1 V ... V -^ip n G Cons£( Ato )(99i) contradicting 
the assumption that Ai,s \= Cons£( Ato )(y?i). 

By definition of |=, U {</?i} is satisfiable in some neighbourhood £(At)-model M at a 
state t in jV, i.e., jV, t |= ^Uj^i}. Then by construction s =£( Ato ) t, and as truth is preserved 
by the injections l: Ai — > M + .M and k: AA — > AA + .M, and when passing to ultrafilter 
extensions, the principal ultrafilters generated by i(s) and n(t) are also modally £(Ato)- 
equivalent in U = (U,(i,V) = (Af + Ai) u , i.e., u t ( s ) = £( A t ) u K (t)- Now since ultrafilter 
extensions are modally £(Ato)-saturated (Lemma 5.10[ 5)) it follows from Lemma 5.10[ 4) 



that =£(At ) is an £( Ato) -congruence on U. For ease of notation, we denote the relation 
=£(At ) on by Z in the rest of this proof. We have, in particular, Z is a congruence on 



the underlying frame (U,n) ofU, and by Proposition 3.20 Z is also a 2 2 -bisimulation on 
{U,/j). This means there exists a coalgebra map C: Z —> 2 2 (Z) such that the projections 
7Tj : (Z,0 — > (U,fj), i = 1,2, are bounded frame morphisms. We now define a valuation V' 
on (Z, Q to obtain a neighbourhood £(At)-model Z = (Z, £, V') such that tti : i? — > ^ is a 
bounded £(Ati)-morphism and tt2 ■ Z — ► U is a bounded £(At2)-morphism. Let p G At and 
(ui,U2) G Z, then we define 

ui G V(p) if p G Ati, 
u 2 G ifpGAt 2 , 
never if p G At \ (Ati U At 2 ). 

Note that V is well-defined due to Lemma 5.10[ 2). The construction is illustrated below. 



(ui,u 2 ) G V'(p) 



The dashed arrow going to IA indicates that the principal ultrafilter map u is not a bounded 
morphism, still u does preserve modal truth (Lemma 4.24j ). 



<P! H A/", t — AA + M ^— M,s^ Cons £(Ato) (^i 
1 

u I EE 

V 

U 



Now we have: A/", t \= ip\ implies U, u K (t) \= fx- Since (u K (t), u t ( s )) G Z and tt\ is a bounded 
£(Ati)-morphism from Z to we have Z,{u K u\,\\ L i s \) \= ip\. By the main assumption 
that \= ifi ^ tp2, we get that Z, (u K (t), u i( s )) N <P2> an d now since tt2 is a bounded £(At-2)- 
morphism from Z to U, we get Z^, u t ( s ) |= (f2 and hence s \= cp2- □ 
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6. Conclusion and related work 

In the first part of this paper we discussed and compared different notions of equivalence 
between neighbourhood structures. We gave back-and-forth style characterisations of 2 2 - 
bisimulations and precocongruences, and showed that, as expected, behavioural equivalence 
is the only one of the three notions that allows us to prove a Hennessy-Milner theorem for 
image-finite neighborhood models (cf. Section |4j). Furthermore, we showed that for an 
arbitrary Set- functo r F, p recocongruences capture behavioural equivalence on a single F- 
coalgebra (Theorem 3.12 ). For functors F that weakly preserve kernel pairs, such as 2 , this 



is already achieved with F-bisimulations [19J, but we believe that precocongruences could 
be an interesting alternative to F-bisimulations for functors which lack this property. A 
first indication of this is [23 where precocongruences are used to obtain a game-theoretic 
characterisation of behavioural equivalence. 

After having reached a good understanding of state equivalence over neighbourhood 
structures, we focused on generalising two well-known model-theoretic results to the setting 



of neighbourhood models: the Van Benthem Characterisation Theorem (Theorem 5.5) and 



Craig Interpolation (Theorem 5.11). Our proof of Theorem 5.5 builds on ideas from the 
original proof of the Van Benthem characterisation theorem ([S ). Closely related to our 
work are also the invariance results by Pauly (|36j) on monotonic modal logic, and Ten Cate 
et al. ([H]) on topological modal logic. 

A number of other model-theoretic results are worth exploring. Perhaps the most 
interesting one is a generalisation of the Goldblatt-Thomason Theorem (see e.g. [TO]). The 
classic result for Kripke models can be proved using model-theoretic constructs or by using 
algebraic duality. The algebraic duality proof has already been generalised to the coalgebraic 
setting by Kurz & Rosicky's [27]. Indeed, a special case of their main result is the result we 
are after: a Goldblatt-Thomason Theorem for neighbourhood models (cf. [27], Corollary 
3.17(2) and Remark 3.18). Given the formal machinery we have developed in this paper 



(e.g., the ultrafilter extensions from Section 4.3), one may hope for a model-theoretic proof 



of this result (see e.g., Section 3.8 in [TO]). Such a model-theoretic proof has been given 
for topological models (which are special cases of neighbourhood models) by Ten Cate et 
al. (pj~|). However, an important ingredient in the model-theoretic proof for the Kripke 
case is the fact that any Kripke model is bisimilar to the disjoint union of its generated 
submodels. This is not true for an arbitrary neighbourhood model (cf. [18 J, and at the 
moment, it is not clear which alternative construction could be used in its place. 

A second model-theoretic issue raised by the results in this paper concerns our transla- 



tion of the modal language into a two-sorted first-order language (cf. Definition 5.2). As is 
well-known, with respect to Kripke structures, the basic modal language can be translated 
into the guarded fragment of first-order logic (cf. [6 ). This fact has been used to explain 
a number of the important properties of modal logic (see, for example, [5] for an extensive 
discussion). The question is whether classical modal logic is also contained in some kind 
of guarded fragment. Our translation of dp does not fall into the guarded fragment of 
two-sorted first-order logic. However, it is not difficult to see that over the class N of neigh- 
bourhood models viewed as first-order structures, st x (\3ip) is equivalent to the following 
single-sorted first-order formula: 

3u(Nbhd(u) A xNu A Vy(vEy -> st y (p)) A \/y(State(y) -> (->(st y (<p)) V uEy))) 

where Nbhd and State are designated predicates intended to mean "...is a neighbourhood" 
and "...is a state", respectively. This formula is in the (loosely) guarded fragment. 
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Our characterisation theorem for classical modal logic leads to a number of interesting 
research questions. For example, we would like to explore the possibility of proving our result 
using game-theoretic techniques similar to the ones exploited by Otto ([32]). Furthermore, 
neighbourhood structures can also be seen as a type of Chu spaces. We would like to 
relate our characterisation theorem to Van Benthem's characterisation of the Chu transform 
invariant fragment of a two-sorted first-order logic in [9] . 

Finally, it would be interesting to find out if our characterisation theorem can be gen- 
eralised to coalgebraic modal logic for an arbitrary finitary functor F : Set — ► Set, using the 
embedding of F-coalgebras into multi-modal, k-aiy neighbourhood frames as described in 



Remark 5.9. It might be possible to prove that, under certain assumptions, the coalgebraic 
modal logic over F-coalgebras can be viewed as the bisimulation invariant fragment of some 
many-sorted first-order logic. Initial investigations suggest that this is possible for functors 
of the form A^ 2 ^ ' where A is a finite set and k is a natural number. An '-coalgebra 
can be seen as a multi-modal, polyadic neighbourhood frame (X, {v a \ a £ A}) given by an 
A-indexed collection of /c-ary neighbourhood functions v a : X — > 2^ 2X ^ k such that for each 
fe-tuple of subsets (Ui, . . . , fTj.) and each state x £ X, (Ui, . . . , Uk) € v a (x) for exactly one 
a € A. We must leave the details of this result as future work. 
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